VDB-134277 · CVE-2019-3929 · Qualys 13484

Crestron AM-100/AM-101 HTTP Endpoint file_transfer.cgi System Command command injection

A vulnerability was found in Crestron AM-100 and AM-101. It has been classified as very critical. This affects an unknown part of the file file_transfer.cgi of the component HTTP Endpoint. It is possible to mitigate the weakness by firewalling .

Timeline

The analysis of the timeline helps to identify the required approach and handling of single vulnerabilities and vulnerability collections. This overview makes it possible to see less important slices and more severe hotspots at a glance. Initiating immediate vulnerability response and prioritizing of issues is possible.

User

Field

Commit Conf

Approve Conf

ID	Commited	User	Field	Change	Remarks	Moderated	Reason	C
8931192	06/05/2020	VulD...	url	https://www.exploit-db.com/exploits/46786/	exploit-db.com	06/05/2020	accepted	100
8931154	06/05/2020	VulD...	discoverydate	1556668800		06/05/2020	accepted	100
8931208	05/01/2019	VulD...	cvss3_nvd_basescore	9.8	nist.gov	05/01/2019	accepted	90
8931207	05/01/2019	VulD...	cvss3_vuldb_rc	C		05/01/2019	accepted	90
8931206	05/01/2019	VulD...	cvss3_vuldb_rl	W		05/01/2019	accepted	90
8931205	05/01/2019	VulD...	cvss3_vuldb_e	X		05/01/2019	accepted	90
8931204	05/01/2019	VulD...	cvss2_vuldb_rc	C		05/01/2019	accepted	90
8931203	05/01/2019	VulD...	cvss2_vuldb_rl	W		05/01/2019	accepted	90
8931202	05/01/2019	VulD...	cvss2_vuldb_e	ND		05/01/2019	accepted	90
8931201	05/01/2019	VulD...	location	Website		05/01/2019	accepted	90
8931200	05/01/2019	VulD...	seealso	134273 134274 134275 134276 134278 134279 134280 134281 134282 134283 134284 134285 134286		05/01/2019	accepted	100
8931199	05/01/2019	VulD...	qualys_title	Crestron AM-100 and AM-101 Multiple Vulnerabilities	qualys.com	05/01/2019	accepted	100
8931198	05/01/2019	VulD...	qualys_id	13484	qualys.com	05/01/2019	accepted	100
8931197	05/01/2019	VulD...	cve_nvd_summary	The Crestron AM-100 firmware 1.6.0.2, Crestron AM-101 firmware 2.7.0.1, Barco wePresent WiPG-1000P firmware 2.3.0.10, Barco wePresent WiPG-1600W before firmware 2.4.1.19, Extron ShareLink 200/250 firmware 2.0.3.4, Teq AV IT WIPS710 firmware 1.1.0.7, SHARP PN-L703WA firmware 1.4.2.3, Optoma WPS-Pro firmware 1.0.0.5, Blackbox HD WPS firmware 1.0.0.5, InFocus LiteShow3 firmware 1.0.16, and InFocus LiteShow4 2.0.0.7 are vulnerable to command injection via the file_transfer.cgi HTTP endpoint. A remote, unauthenticated attacker can use this vulnerability to execute operating system commands as root.	mitre.org	05/01/2019	accepted	100
8931196	05/01/2019	VulD...	cve_assigned	1546473600	mitre.org	05/01/2019	accepted	100
8931195	05/01/2019	VulD...	cve	CVE-2019-3929	mitre.org	05/01/2019	accepted	100
8931194	05/01/2019	VulD...	name	Firewall		05/01/2019	accepted	100
8931193	05/01/2019	VulD...	price_0day	$0-$5k	see documentation	05/01/2019	accepted	100
8931191	05/01/2019	VulD...	date	1556582400 (04/30/2019)		05/01/2019	accepted	100
8931190	05/01/2019	VulD...	cvss3_nvd_a	H	nist.gov	05/01/2019	accepted	100