CVE-2023-6926: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in Crestron AM-300
First published: Tue Jan 23 2024(Updated: )
There is an OS command injection vulnerability in Crestron AM-300 firmware version 1.4499.00018 which may enable a user of a limited-access SSH session to escalate their privileges to root-level access.
Credit: ics-cert@hq.dhs.gov
| Affected Software | Affected Version | How to fix |
|---|---|---|
| All of | ||
| Crestron AM-300 firmware | =1.4499.00018 | |
| Crestron AM-300 |
Remedy
Crestron has resolved this vulnerability in firmware version 1.4499.00023.001 or higher. Please see https://security.crestron.com https://security.crestron.com/ or contact True Blue Support for additional information.
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
- collector/mitre-cve
- source/MITRE
- agent/remedy
- agent/weakness
- agent/title
- agent/references
- agent/description
- agent/type
- agent/first-publish-date
- agent/author
- agent/event
- agent/severity
- agent/last-modified-date
- agent/softwarecombine
- agent/tags
- collector/nvd-api
- source/NVD
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- vendor/crestron
- canonical/crestron am-300 firmware
- version/crestron am-300 firmware/1.4499.00018
- canonical/crestron am-300