CVE-2025-47417: Enable Debug Images

Published May 6, 2025
·
Updated

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Crestron Automate VX allows Functionality Misuse.

When Enable Debug Images in Crestron Automate VX is active, snapshots of the captured video or portions thereof are stored locally on the system, and there is no visible indication that this is being done.

This issue affects Automate VX: from 5.6.8161.21536 through 6.4.0.49.

Affected Software

1 affected component
Crestron Automate VX>=5.6.8161.21536<=6.4.0.49

Remediation

Information

Crestron recommends updating the software to firmware version 6.4.1.8 or higher. The firmware update will automatically disables the Enable Debug Images Mode on system startup and reboot (which occurs daily), or if manually disabled, whichever occurs first, and automatically deletes captured images in 24 hours. While active, a visual overlay is applied to the program video output indicating Debug Images Enabled.

Event History

May 6, 2025
CVE Published
via MITRE·07:49 PM
Data Sourced
via MITRE·07:49 PM
RemedyDescriptionWeakness
Data Sourced
via NVD·08:15 PM
DescriptionSeverityWeakness
Feb 10, 57332
Event
via FIRST·12:33 PM
Free Weekly Intel

Don't miss critical vulnerabilities

Join thousands of security professionals who receive our weekly digest of trending CVEs, zero-days, and exploited vulnerabilities.

No spam. Unsubscribe anytime.

Frequently Asked Questions

1

What is the severity of CVE-2025-47417?

The severity of CVE-2025-47417 is considered high due to the potential exposure of sensitive information.

2

How do I fix CVE-2025-47417?

To mitigate CVE-2025-47417, disable the 'Enable Debug Images' option in Crestron Automate VX.

3

What types of systems are affected by CVE-2025-47417?

CVE-2025-47417 affects Crestron Automate VX versions between 5.6.8161.21536 and 6.4.0.49.

4

What information is exposed in CVE-2025-47417?

CVE-2025-47417 allows snapshots of captured video to be stored locally, potentially exposing sensitive visual data.

5

Can CVE-2025-47417 be exploited remotely?

CVE-2025-47417 requires local access to the system for the exploitation to occur.

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203