A vulnerability, which was classified as very critical, has been found in Crestron AM-100 and AM-101. This issue affects some unknown processing of the component SNMP. The manipulation as part of a System Command leads to a command injection vulnerability. Using CWE to declare the problem leads to CWE-77. The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component. Impacted is confidentiality, integrity, and availability. The summary by CVE is:

Crestron AM-100 with firmware 1.6.0.2 and AM-101 with firmware 2.7.0.2 are vulnerable to command injection via SNMP OID iso.3.6.1.4.1.3212.100.3.2.9.3. A remote, unauthenticated attacker can use this vulnerability to execute operating system commands as root.

The bug was discovered 05/01/2019. The weakness was presented 04/30/2019. The identification of this vulnerability is CVE-2019-3925 since 01/03/2019. The attack may be initiated remotely. No form of authentication is needed for a successful exploitation. Neither technical details nor an exploit are publicly available. The price for an exploit might be around USD $0-$5k at the moment (estimation calculated on 09/11/2023). MITRE ATT&CK project uses the attack technique T1202 for this issue.

The commercial vulnerability scanner Qualys is able to test this issue with plugin 13484 (Crestron AM-100 and AM-101 Multiple Vulnerabilities).

Addressing this vulnerability is possible by firewalling udp/161 (snmp).

See 134274, 134275, 134276 and 134277 for similar entries.

Affected

• Crestron AM-100 1.6.0.2
• Crestron AM-101 2.7.0.2

Productinfo

Vendor

• Crestron

Name

• AM-100
• AM-101

License

• commercial

CPE 2.3info

• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Discussion