CVE-2019-3932: Critical severity crestron airmedia am-100 firmware vulnerability
Published Apr 30, 2019
·Updated
Crestron AM-100 with firmware 1.6.0.2 and AM-101 with firmware 2.7.0.2 are vulnerable to authentication bypass due to a hard-coded password in return.tgi. A remote, unauthenticated attacker can use this vulnerability to control external devices via the uartbridge.
Affected Software
8 affected components
All of the following
Crestron AM-100 firmware=1.6.0.2
Crestron AM-100
All of the following
Crestron AM-101 firmware=2.7.0.2
Crestron AM-101
Crestron AM-100 firmware=1.6.0.2
Crestron AM-100
Crestron AM-101 firmware=2.7.0.2
Crestron AM-101
Event History
Apr 30, 2019
CVE Published
via MITRE·08:30 PM
Data Sourced
via MITRE·08:30 PM
DescriptionWeakness
Data Sourced
via NVD·09:29 PM
DescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2019-3932?
The severity of CVE-2019-3932 is critical with a score of 9.8.
2
Which devices are affected by CVE-2019-3932?
Crestron AM-100 with firmware 1.6.0.2 and AM-101 with firmware 2.7.0.2 are affected by CVE-2019-3932.
3
How does CVE-2019-3932 allow for authentication bypass?
CVE-2019-3932 allows for authentication bypass due to a hard-coded password in return.tgi.
4
Can the vulnerability be exploited remotely?
Yes, the vulnerability can be exploited remotely by a remote, unauthenticated attacker.
5
What can an attacker do by exploiting CVE-2019-3932?
By exploiting CVE-2019-3932, an attacker can control external devices via the uart_bridge.