Crestron Multiple Products

What it is

Multiple Crestron products are vulnerable to command injection via the file_transfer.cgi HTTP endpoint. A remote, unauthenticated attacker can use this vulnerability to execute operating system commands as root.

What to do

Apply updates per vendor instructions.

Vendor notices and references

• nvd.nist.gov/vuln/detail/CVE-2019-3929

Description and required action as published by CISA. Full record at NVD.