CVE-2019-3931: crestron am-100_firmware Argument Injection

Vulnerability summary

CVE-2019-3931 is a high (CVSS 9.0) Argument Injection vulnerability in crestron am-100_firmware. EPSS estimates a 5.77% chance of exploitation in the next 30 days, higher than 93% of scored vulnerabilities. 1 public exploit is recorded.

Timeline

1. 30-04-2019
   PublishedVulnerability first disclosed.
2. 04-08-2024
   Last modifiedVulnerability information updated.

Description

Crestron AM-100 with firmware 1.6.0.2 and AM-101 with firmware 2.7.0.2 are vulnerable to argumention injection to the curl binary via crafted HTTP requests to return.cgi. A remote, authenticated attacker can use this vulnerability to upload files to the device and ultimately execute code as root.

• CWE-88Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')The product constructs a string for a command to be executed by a separate component in another control sphere, but it does not properly delimit the intended arguments, options, or switches within that command string.