Crestron vulnerabilities
47 vulnerabilities
Known vulnerabilities in Crestron products, newest first, with CVSS severity, EPSS, KEV listings and ransomware use, across 29 products.
Products
29- Am 10015 vulnerabilities
- Am 10115 vulnerabilities
- Crestron Airmedia13 vulnerabilities
- Dm Txrx 100 Str6 vulnerabilities
- Airmedia Am 1005 vulnerabilities
- Airmedia4 vulnerabilities
- Automate VX4 vulnerabilities
- Airmedia Am 1012 vulnerabilities
- Crestron Airmedia, Barco Wepresent, Extron Sharelink, Teq AV IT Wips710, Sharp PN L703Wa, Optoma WPS Pro, Blackbox HD WPS, Infocus Liteshow3, And Infocus Liteshow4.2 vulnerabilities
- Crestron Toolbox Protocol2 vulnerabilities
- Mc32 vulnerabilities
- Tsw X602 vulnerabilities
- Am 3001 vulnerabilities
- Cp3 65048771 vulnerabilities
- Cp3 Gv 65060341 vulnerabilities
- Cp3N 65054171 vulnerabilities
- Dge 1001 vulnerabilities
- Dm Dge 200 C1 vulnerabilities
- Dm Nvx Dir 1601 vulnerabilities
- Dm Nvx Dir 801 vulnerabilities
- Dm Nvx Dir Ent1 vulnerabilities
- Dmc Stro1 vulnerabilities
- Hd Md4X2 4K E1 vulnerabilities
- Touchscreen X60S1 vulnerabilities
- Touchscreen X701 vulnerabilities
- Touchscreens X60, X70 Series1 vulnerabilities
- Touchscreens X701 vulnerabilities
- Ts 1542 C1 vulnerabilities
- Multiple Products0 vulnerabilities
CVE-2018-13341crestronmc3_firmware+1
EPSS score3.66%
Crestron TSW-X60 all versions prior to 2.001.0037.001 and MC3 all versions prior to 1.502.0047.00, The passwords for special sudo accounts may be calculated using information accessible to those with regular user privileges. Attackers could decipher these passwords, which may allow them to execute hidden API calls and escape the CTP console sandbox environment with elevated privileges.CVE-2018-11229crestroncrestron_toolbox_protocol_firmwareEPSS score5.56%
Crestron TSW-1060, TSW-760, TSW-560, TSW-1060-NC, TSW-760-NC, and TSW-560-NC devices before 2.001.0037.001 allow unauthenticated remote code execution via command injection in Crestron Toolbox Protocol (CTP).CVE-2018-11228crestroncrestron_toolbox_protocol_firmwareEPSS score7.39%
Crestron TSW-1060, TSW-760, TSW-560, TSW-1060-NC, TSW-760-NC, and TSW-560-NC devices before 2.001.0037.001 allow unauthenticated remote code execution via a Bash shell service in Crestron Toolbox Protocol (CTP).CVE-2018-5553crestrondge-100_firmware+2EPSS score2.49%
The Crestron Console service running on DGE-100, DM-DGE-200-C, and TS-1542-C devices with default configuration and running firmware versions 1.3384.00049.001 and lower are vulnerable to command injection that can be used to gain root-level access.CVE-2018-10630crestronmc3_firmware+2EPSS score10.51%
For Crestron TSW-X60 version prior to 2.001.0037.001 and MC3 version prior to 1.502.0047.001, The devices are shipped with authentication disabled, and there is no indication to users that they need to take steps to enable it. When compromised, the access to the CTP console is left open.CVE-2016-5671crestrondm-txrx-100-str_firmwareEPSS score0.86%
Multiple cross-site request forgery (CSRF) vulnerabilities on Crestron Electronics DM-TXRX-100-STR devices with firmware through 1.3039.00040 allow remote attackers to hijack the authentication of arbitrary users.CVE-2016-5670crestrondm-txrx-100-str_firmwareEPSS score3.19%
Crestron Electronics DM-TXRX-100-STR devices with firmware before 1.3039.00040 have a hardcoded password of admin for the admin account, which makes it easier for remote attackers to obtain access via the web management interface.CVE-2016-5640crestronairmedia_am-100_firmwareEPSS score17.71%
Directory traversal vulnerability in cgi-bin/rftest.cgi on Crestron AirMedia AM-100 devices with firmware before 1.4.0.13 allows remote attackers to execute arbitrary commands via a .. (dot dot) in the ATE_COMMAND parameter.CVE-2016-5668crestrondm-txrx-100-str_firmwareEPSS score4.43%
Crestron Electronics DM-TXRX-100-STR devices with firmware before 1.3039.00040 allow remote attackers to bypass authentication and change settings via a JSON API call.CVE-2016-5666crestrondm-txrx-100-str_firmwareEPSS score4.20%
Crestron Electronics DM-TXRX-100-STR devices with firmware before 1.3039.00040 rely on the client to perform authentication, which allows remote attackers to obtain access by setting the value of objresp.authenabled to 1.CVE-2016-5669crestrondm-txrx-100-str_firmwareEPSS score1.62%
Crestron Electronics DM-TXRX-100-STR devices with firmware before 1.3039.00040 use a hardcoded 0xb9eed4d955a59eb3 X.509 certificate from an OpenSSL Test Certification Authority, which makes it easier for remote attackers to conduct man-in-the-middle attacks against HTTPS sessions by leveraging the certificate's trust relationship.CVE-2016-5667crestrondm-txrx-100-str_firmwareEPSS score4.43%
Crestron Electronics DM-TXRX-100-STR devices with firmware before 1.3039.00040 allow remote attackers to bypass authentication via a direct request to a page other than index.html.CVE-2016-5639crestronairmedia_am-100_firmwareEPSS score20.84%
Directory traversal vulnerability in cgi-bin/login.cgi on Crestron AirMedia AM-100 devices with firmware before 1.4.0.13 allows remote attackers to read arbitrary files via a .. (dot dot) in the src parameter.CVE-2025-47415crestrontouchscreens x60, x70 seriesEPSS score0.46%
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in CRESTRON TOUCHSCREENS x70 allows Relative Path Traversal.This issue affects TOUCHSCREENS x70: from 3.000.0110.001 before 3.001.0031.001.
Confirmed Affected Hardware: TSW-760, TSW-1060
Confirmed Affected Firmware: 3.002.1061 - (no fix released, product discontinued)
For x70
The Affected Firmware:- 3.000.0110.001 and versions below
The Fixed Firmware:- 3.001.0031.001CVE-2025-47419crestronautomate vxEPSS score0.29%
Cleartext Transmission of Sensitive Information vulnerability in Crestron Automate VX allows Sniffing Network Traffic.
The device allows Web UI and API access over non-secure network ports which exposes sensitive information such as user passwords.
This issue affects Automate VX: from 5.6.8161.21536 through 6.4.0.49.CVE-2025-47417crestronautomate vxEPSS score0.44%
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Crestron Automate VX allows Functionality Misuse.
When Enable Debug Images in Crestron Automate VX is active, snapshots of the captured video or portions thereof are stored locally on the system, and there is no visible indication that this is being done.
This issue affects Automate VX: from 5.6.8161.21536 through 6.4.0.49.CVE-2025-47420crestronautomate vxEPSS score0.38%
266 vulnerability in Crestron Automate VX allows Privilege Escalation.This issue affects Automate VX: from 5.6.8161.21536 through 6.4.0.49.CVE-2025-47416crestrontouchscreen x60s+1EPSS score0.37%
A vulnerability exists in the ConsoleFindCommandMatchList function in libsymproc. so imported by ctpd that may lead to unauthorized execution of an attacker-defined file that gets prioritized by the ConsoleFindCommandMatchList.
A third-party researcher discovered that the ConsoleFindCommandMatchList enumerates the /dev/shm/symproc/c directory in alphabetical order to identify console commands. Permission levels are inferred from the integer values present in each command's file name.
Confirmed Affected Hardware: TSW-760, TSW-1060
Confirmed Affected Firmware: 3.002.1061
Fixed Firmware: no fixed released (product is discontinued and end of life)
For x70
The Affected Firmware:- 3.000.0110.001 and versions below
The Fixed Firmware:- 3.001.0031.001CVE-2025-47418crestronautomate vxEPSS score0.43%
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Crestron Automate VX allows Functionality Misuse.
There is no visible indication when the system is recording and recording can be enabled remotely via a network API.
This issue affects Automate VX: from 5.6.8161.21536 through 6.4.0.49.CVE-2025-47421crestrontouchscreens x70EPSS score0.37%
Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') vulnerability in CRESTRON TOUCHSCREENS x70 allows Argument Injection.This issue affects TOUCHSCREENS x70: from 3.001.0031.001 through 3.001.0034.001.
A specially crafted SCP command sent via SSH login string can lead a valid administrator user to gain Privileged Operating System access on the device.
Following Products Models are affected:
TSW-x70
TSW-x60
TST-1080
AM-3000/3100/3200
Soundbar VB70
HD-PS622/621/402
HD-TXU-RXU-4kZ-211
HD-MDNXM-4KZ-E
*Note: additional firmware updates will be published once made available