Vulnerabilities > Crestron

DATE CVE VULNERABILITY TITLE RISK
2019-01-18 CVE-2019-3910 Unspecified vulnerability in Crestron Airmedia Am-100 Firmware
Crestron AM-100 before firmware version 1.6.0.2 contains an authentication bypass in the web interface's return.cgi script.
network
low complexity
crestron
8.5
2018-08-10 CVE-2018-13341 Unspecified vulnerability in Crestron MC3 Firmware and Tsw-X60 Firmware
Crestron TSW-X60 all versions prior to 2.001.0037.001 and MC3 all versions prior to 1.502.0047.00, The passwords for special sudo accounts may be calculated using information accessible to those with regular user privileges.
network
low complexity
crestron
4.0
2018-08-10 CVE-2018-10630 Improper Authentication vulnerability in Crestron MC3 Firmware and Tsw-X60 Firmware
For Crestron TSW-X60 version prior to 2.001.0037.001 and MC3 version prior to 1.502.0047.001, The devices are shipped with authentication disabled, and there is no indication to users that they need to take steps to enable it.
network
low complexity
crestron CWE-287
critical
10.0
2018-07-11 CVE-2017-16710 Cross-site Scripting vulnerability in Crestron Airmedia Am-100 Firmware and Airmedia Am-101 Firmware
Cross-site scripting (XSS) vulnerability in Crestron Airmedia AM-100 devices with firmware before 1.6.0 and AM-101 devices with firmware before 2.7.0 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
network
crestron CWE-79
3.5
2018-07-11 CVE-2017-16709 Unspecified vulnerability in Crestron Airmedia Am-100 Firmware and Airmedia Am-101 Firmware
Crestron Airmedia AM-100 devices with firmware before 1.6.0 and AM-101 devices with firmware before 2.7.0 allows remote authenticated administrators to execute arbitrary code via unspecified vectors.
network
low complexity
crestron
6.5
2018-07-10 CVE-2018-5553 OS Command Injection vulnerability in Crestron products
The Crestron Console service running on DGE-100, DM-DGE-200-C, and TS-1542-C devices with default configuration and running firmware versions 1.3384.00049.001 and lower are vulnerable to command injection that can be used to gain root-level access.
network
low complexity
crestron CWE-78
critical
10.0
2018-06-08 CVE-2018-11229 OS Command Injection vulnerability in Crestron Toolbox Protocol Firmware
Crestron TSW-1060, TSW-760, TSW-560, TSW-1060-NC, TSW-760-NC, and TSW-560-NC devices before 2.001.0037.001 allow unauthenticated remote code execution via command injection in Crestron Toolbox Protocol (CTP).
network
low complexity
crestron CWE-78
7.5
2018-06-08 CVE-2018-11228 Code Injection vulnerability in Crestron Toolbox Protocol Firmware
Crestron TSW-1060, TSW-760, TSW-560, TSW-1060-NC, TSW-760-NC, and TSW-560-NC devices before 2.001.0037.001 allow unauthenticated remote code execution via a Bash shell service in Crestron Toolbox Protocol (CTP).
network
low complexity
crestron CWE-94
critical
10.0
2016-08-03 CVE-2016-5671 Cross-Site Request Forgery (CSRF) vulnerability in Crestron Dm-Txrx-100-Str Firmware
Multiple cross-site request forgery (CSRF) vulnerabilities on Crestron Electronics DM-TXRX-100-STR devices with firmware through 1.3039.00040 allow remote attackers to hijack the authentication of arbitrary users.
network
crestron CWE-352
6.8
2016-08-03 CVE-2016-5670 Credentials Management vulnerability in Crestron Dm-Txrx-100-Str Firmware 1.2866.00026
Crestron Electronics DM-TXRX-100-STR devices with firmware before 1.3039.00040 have a hardcoded password of admin for the admin account, which makes it easier for remote attackers to obtain access via the web management interface.
network
low complexity
crestron CWE-255
critical
10.0