PT-2019-16782 · Crestron · Crestron Am-100 +1

Name of the Vulnerable Software and Affected Versions: Crestron AM-100 version 1.6.0.2 Crestron AM-101 version 2.7.0.2 Description: The issue allows any user to obtain the presentation passcode via specific OIDs, iso.3.6.1.4.1.3212.100.3.2.7.4. A remote, unauthenticated attacker can exploit this ...

Authentication flaw

Crestron AM-100 before firmware version 1.6.0.2 contains an authentication bypass in the web interface's return.cgi script. Unauthenticated remote users can use the bypass to access some administrator functionality such as configuring update sources and rebooting the device...

CVE-2019-3910

Crestron AM-100 before firmware version 1.6.0.2 contains an authentication bypass in the web interface's return.cgi script. Unauthenticated remote users can use the bypass to access some administrator functionality such as configuring update sources and rebooting the device...

CVE-2019-3910

The CVE-2019-3910 issue affects Crestron AM-100 devices running firmware before 1.6.0.2. Affected component is the web interface’s return.cgi script, enabling an authentication bypass that allows unauthenticated remote access to administrator-level functions (e.g., configuring update sources and ...

Crestron Multiple Products CTP Console EDIDMUX Command Injection Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Crestron's Android-based products. Authentication is not required to exploit this vulnerability. The specific flaw exists within the EDIDMUX command of the CTP console. The issue results from the...

AwindInc SNMP Service Command Injection

This module exploits a vulnerability found in AwindInc and OEM'ed products where untrusted inputs are fed to ftpfw.sh system command, leading to command injection. A valid SNMP read-write community is required to exploit this vulnerability. The following devices are known to be affected by this...

Crestron AirMedia Presentation Gateway Detection (SNMP)

SNMP based detection of Crestron AirMedia Presentation Gateway devices. SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only if description...

Crestron Multiple Products CTP Console FPUTFILE Command Injection Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Crestron's Android-based products. Authentication is not required to exploit this vulnerability. The specific flaw exists within the FPUTFILE command of the CTP console. The issue results from the...

Crestron Multiple Products CTP Console WIFISSID Command Injection Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Crestron's Android-based products. Authentication is not required to exploit this vulnerability. The specific flaw exists within the WIFISSID command of the CTP console. The issue results from the...

Crestron Multiple Products CTP Console COPYFILE Command Injection Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Crestron's Android-based products. Authentication is not required to exploit this vulnerability. The specific flaw exists within the COPYFILE command of the CTP console. The issue results from the...

Crestron Multiple Products CTP Console PING Command Injection Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Crestron's Android-based products. Authentication is not required to exploit this vulnerability. The specific flaw exists within the PING command of the CTP console. The issue results from the lack...

Crestron Multiple Products CTP Console WIFIPSKPASSWORD Command Injection Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Crestron's Android-based products. Authentication is not required to exploit this vulnerability. The specific flaw exists within the WIFIPSKPASSWORD command of the CTP console. The issue results fr...

Crestron Multiple Products CTP Console REMOVEDIR Command Injection Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Crestron's Android-based products. Authentication is not required to exploit this vulnerability. The specific flaw exists within the REMOVEDIR command of the CTP console. The issue results from the...

Crestron Multiple Products CTP Console Incorrect Default Permissions Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute execute arbitrary code on vulnerable installations of Crestron products. Authentication is not required to exploit this vulnerability. The specific flaw exists due to authentication being disabled by default on all Crestron devices. An attacke...

Crestron Multiple Products CTP Console ISDIR Command Injection Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Crestron's Android-based products. Authentication is not required to exploit this vulnerability. The specific flaw exists within the ISDIR command of the CTP console. The issue results from the lac...

Crestron Multiple Products CTP Console UDIR Command Injection Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Crestron's Android-based products. Authentication is not required to exploit this vulnerability. The specific flaw exists within the UDIR command of the CTP console. The issue results from the lack...

Crestron Multiple Products CTP Console MOVEFILE Command Injection Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Crestron's Android-based products. Authentication is not required to exploit this vulnerability. The specific flaw exists within the MOVE command of the CTP console. The issue results from the lack...

Crestron Multiple Products CTP Console DELETE Command Injection Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Crestron's Android-based products. Authentication is not required to exploit this vulnerability. The specific flaw exists within the DELETE command of the CTP console. The issue results from the la...

Crestron Multiple Products CTP Console FGETFILE Command Injection Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Crestron's Android-based products. Authentication is not required to exploit this vulnerability. The specific flaw exists within the FGETFILE command of the CTP console. The issue results from the...

Crestron Multiple Products CTP Console WIFIWEPPASSWORD Command Injection Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Crestron's Android-based products. Authentication is not required to exploit this vulnerability. The specific flaw exists within the WIFIWEPPASSWORD command of the CTP console. The issue results fr...