CVE-2023-6926: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in Crestron AM-300
Published Jan 23, 2024
·Updated
There is an OS command injection vulnerability in Crestron AM-300 firmware version 1.4499.00018 which may enable a user of a limited-access SSH session to escalate their privileges to root-level access.
Affected Software
2 affected components
All of the following
Crestron AM-300 firmware=1.4499.00018
Crestron AM-300
Remediation
Information
Crestron has resolved this vulnerability in firmware version 1.4499.00023.001 or higher. Please see https://security.crestron.com https://security.crestron.com/ or contact True Blue Support for additional information.
Event History
Jan 23, 2024
CVE Published
via MITRE·07:23 PM
Data Sourced
via MITRE·07:23 PM
RemedyDescriptionSeverityWeakness
Data Sourced
via NVD·08:15 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
What is the severity of CVE-2023-6926?
CVE-2023-6926 is classified as a critical vulnerability allowing privilege escalation.
2
How do I fix CVE-2023-6926?
To mitigate CVE-2023-6926, update the Crestron AM-300 firmware to a version beyond 1.4499.00018.
3
Who is affected by CVE-2023-6926?
CVE-2023-6926 affects users operating the Crestron AM-300 firmware version 1.4499.00018.
4
What kind of vulnerability is CVE-2023-6926?
CVE-2023-6926 is an OS command injection vulnerability that can be exploited through a limited-access SSH session.
5
Can I exploit CVE-2023-6926 remotely?
Exploitation of CVE-2023-6926 requires access to a limited-access SSH session on the affected device.