CVE-2019-3931: Critical severity crestron airmedia am-100 firmware vulnerability
Crestron AM-100 with firmware 1.6.0.2 and AM-101 with firmware 2.7.0.2 are vulnerable to argumention injection to the curl binary via crafted HTTP requests to return.cgi. A remote, authenticated attacker can use this vulnerability to upload files to the device and ultimately execute code as root.
Affected Software
Event History
Frequently Asked Questions
What is the vulnerability ID of this vulnerability?
The vulnerability ID of this vulnerability is CVE-2019-3931.
What is the severity of CVE-2019-3931?
The severity of CVE-2019-3931 is critical with a severity value of 8.8.
Which devices are affected by CVE-2019-3931?
Crestron AM-100 with firmware 1.6.0.2 and AM-101 with firmware 2.7.0.2 are affected by CVE-2019-3931.
How does CVE-2019-3931 work?
CVE-2019-3931 allows a remote, authenticated attacker to perform argument injection to the curl binary through crafted HTTP requests to return.cgi, enabling them to upload files to the affected device and execute code as root.
Is there a fix available for CVE-2019-3931?
It is recommended to update the firmware of the Crestron AM-100 and AM-101 devices to versions that are not vulnerable.