CVE-2019-3929
Crestron Multiple Products Command Injection Vulnerability
Description
CVE-2019-3929 is a command injection vulnerability affecting multiple Crestron products through the file_transfer.cgi HTTP endpoint. This critical vulnerability allows a remote, unauthenticated attacker to execute arbitrary operating system commands as root on the affected devices. The command injection flaw in Crestron products requires no authentication and provides the highest level of system access, making it trivially exploitable for full device compromise. CISA has added CVE-2019-3929 to the Known Exploited Vulnerabilities catalog with a remediation deadline of May 6, 2022. The EPSS percentile of approximately 99.96% indicates near-certain exploitation activity, placing this among the most exploited IoT/AV device vulnerabilities.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorCWEs
Affected Products
| Vendor | Product | Version |
|---|---|---|
| crestron | am-100 firmware | 1.6.0.2 |
| crestron | am-101 firmware | 2.7.0.2 |
| barco | wepresent wipg-1000p firmware | 2.3.0.10 |
| barco | wepresent wipg-1600w firmware | < 2.4.1.19 |
| extron | sharelink 200 firmware | 2.0.3.4 |
| extron | sharelink 250 firmware | 2.0.3.4 |
| teqavit | wips710 firmware | 1.1.0.7 |
| sharp | pn-l703wa firmware | 1.4.2.3 |
| optoma | wps-pro firmware | 1.0.0.5 |
| blackbox | hd wireless presentation system firmware | 1.0.0.5 |
| infocus | liteshow3 firmware | 1.0.16 |
| infocus | liteshow4 firmware | 2.0.0.7 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- http://packetstormsecurity.com/files/152715/Barco-AWIND-OEM-Presentation-Platform-Unauthenticated-Remote-Command-Injection.html(Third Party Advisory, VDB Entry)
- http://packetstormsecurity.com/files/155948/Barco-WePresent-file_transfer.cgi-Command-Injection.html(Third Party Advisory, VDB Entry)
- https://www.exploit-db.com/exploits/46786/(Exploit, Third Party Advisory, VDB Entry)
- https://www.tenable.com/security/research/tra-2019-20(Exploit, Third Party Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-3929(US Government Resource)
Weakness Type
CWE-78: Improper Neutralization of Special Elements used in an OS Command (OS Command Injection)
The command injection vulnerability in Crestron products occurs when the file_transfer.cgi endpoint fails to properly sanitize user-supplied input before incorporating it into operating system commands. In CVE-2019-3929, an unauthenticated attacker can inject arbitrary shell commands through the HTTP request to the file_transfer.cgi endpoint, which are then executed by the system with root privileges.
Learn more: CWE-78 — Improper Neutralization of Special Elements used in an OS Command (OS Command Injection)
Impact Analysis
CVE-2019-3929 is remotely exploitable over the network without any authentication or user interaction, making it one of the most easily exploitable vulnerabilities in the Crestron product line. The command injection through the file_transfer.cgi endpoint provides immediate root-level command execution, granting the attacker complete control over the affected device. Since Crestron products are typically deployed in conference rooms, building automation systems, and AV environments in corporate and government facilities, a compromised device can serve as a pivot point for lateral movement into internal networks. The EPSS percentile of approximately 99.96% indicates near-certain exploitation activity, and the unauthenticated root-level access makes this vulnerability exceptionally dangerous for organizations that have not patched or isolated their Crestron equipment.
Exploit Maturity
CISA has confirmed active exploitation of CVE-2019-3929 in the wild by including it in the Known Exploited Vulnerabilities catalog with a remediation deadline of May 6, 2022. The EPSS percentile of approximately 99.96% indicates near-certain exploitation activity, placing this among the most exploited IoT/AV device vulnerabilities. The trivial nature of exploitation, requiring only a single unauthenticated HTTP request to achieve root command execution, combined with the widespread deployment of Crestron products in corporate environments, makes this vulnerability a high-value target for both opportunistic and targeted attacks against network-connected audiovisual and building automation infrastructure.
Remediation
-
Apply Crestron firmware updates immediately as directed by CISA: "Apply updates per vendor instructions." Update all affected Crestron products to firmware versions that address the command injection vulnerability in the file_transfer.cgi endpoint.
-
Isolate Crestron devices on dedicated network segments separate from corporate IT infrastructure. Place all AV and building automation equipment on VLANs with strict access control lists (ACLs) that prevent direct communication with sensitive internal networks.
-
Block direct internet access to Crestron devices and ensure that the file_transfer.cgi endpoint and other management interfaces are not accessible from untrusted networks. Deploy firewall rules to restrict access to Crestron management ports to authorized administrator IP addresses only.
-
Audit your environment for exposed Crestron devices using vulnerability scanning tools and internet-facing asset discovery. Check for Crestron devices that may be inadvertently exposed to the internet through port forwarding rules, misconfigured firewalls, or cloud-connected AV management platforms.
-
Monitor for indicators of compromise on Crestron devices by reviewing device logs for suspicious HTTP requests to the file_transfer.cgi endpoint, unexpected command execution, and signs of unauthorized access or configuration changes. Implement network monitoring to detect unusual traffic patterns to and from Crestron equipment.
Technical Details
CVE-2019-3929 is an OS command injection vulnerability (CWE-78) in multiple Crestron products that allows unauthenticated remote code execution through the file_transfer.cgi HTTP endpoint. The vulnerability exists because the CGI script processes HTTP request parameters without properly sanitizing them before passing them to operating system shell commands. An attacker can inject arbitrary commands by including shell metacharacters (such as semicolons, pipes, or command substitution syntax) in the HTTP request parameters, which are then interpreted and executed by the system shell with root privileges. The attack requires only a single HTTP request to the vulnerable endpoint, with no authentication, no special conditions, and no user interaction, providing immediate root-level access to the underlying operating system of the Crestron device.
Frequently Asked Questions
Is CVE-2019-3929 being actively exploited?
Yes, CVE-2019-3929 is being actively exploited in the wild. CISA has added this vulnerability to the Known Exploited Vulnerabilities catalog with a remediation deadline of May 6, 2022. The EPSS percentile of approximately 99.96% confirms near-certain exploitation activity.
What products are affected by CVE-2019-3929?
CVE-2019-3929 affects multiple Crestron products that include the vulnerable file_transfer.cgi endpoint. Crestron devices are commonly deployed as audiovisual and building automation controllers in corporate, government, and educational environments.
How do I fix CVE-2019-3929?
Apply Crestron firmware updates that address the command injection vulnerability. Isolate Crestron devices on dedicated network segments, block internet access to management interfaces, and audit your environment for exposed devices.
How severe is CVE-2019-3929?
CVE-2019-3929 is an extremely severe vulnerability with an EPSS percentile of approximately 99.96%. The command injection provides unauthenticated root-level remote code execution through a simple HTTP request, making it trivially exploitable for full device compromise and potential network pivoting.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.