NetSight
IP …
critical9.8Known exploitedPublic exploit code

CVE-2019-3929

Crestron Multiple Products Command Injection Vulnerability

Exploited in the wild

This vulnerability is on a Known Exploited Vulnerabilities catalogue, added 2022-04-15. Federal due date: 2022-05-06.

Apply updates per vendor instructions.

Public exploit code

Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.

Impact

The Crestron AM-100 firmware 1.6.0.2, Crestron AM-101 firmware 2.7.0.1, Barco wePresent WiPG-1000P firmware 2.3.0.10, Barco wePresent WiPG-1600W before firmware 2.4.1.19, Extron ShareLink 200/250 firmware 2.0.3.4, Teq AV IT WIPS710 firmware 1.1.0.7, SHARP PN-L703WA firmware 1.4.2.3, Optoma WPS-Pro firmware 1.0.0.5, Blackbox HD WPS firmware 1.0.0.5, InFocus LiteShow3 firmware 1.0.16, and InFocus LiteShow4 2.0.0.7 are vulnerable to command injection via the file_transfer.cgi HTTP endpoint. A remote, unauthenticated attacker can use this vulnerability to execute operating system commands as root.

Affected products

VendorProductAffected versions
CrestronAm-100 Firmware
Version 1.6.0.2
CrestronAm-101 Firmware
Version 2.7.0.2
BarcoWepresent Wipg-1000p Firmware
Version 2.3.0.10
BarcoWepresent Wipg-1600w Firmware
before 2.4.1.19
ExtronSharelink 200 Firmware
Version 2.0.3.4
ExtronSharelink 250 Firmware
Version 2.0.3.4
TeqavitWips710 Firmware
Version 1.1.0.7
SharpPn-L703wa Firmware
Version 1.4.2.3
OptomaWps-Pro Firmware
Version 1.0.0.5
BlackboxHd Wireless Presentation System Firmware
Version 1.0.0.5
InfocusLiteshow3 Firmware
Version 1.0.16
InfocusLiteshow4 Firmware
Version 2.0.0.7

Weakness classification

CWE-79CWE-78

References