Latest vulnerabilities for "crestron automate vx"

Where

Sort:

Crestron Automate VXUser Permissions on Network API

Risk 56

Severity

8.7

EPSS

0.04%

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

266 vulnerability in Crestron Automate VX allows Privilege Escalation.This issue affects Automate VX: from 5.6.8161.21536 through 6.4.0.49.

Remedy

Crestron recommends updating to firmware version 6.4.1.8 or higher. The firmware version will applies user permissions to API requests.

First published (updated )

CVE-2025-47420

Crestron Automate VXNon-Secure Access

Risk 61

Severity

EPSS

0.02%

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Cleartext Transmission of Sensitive Information vulnerability in Crestron Automate VX allows Sniffing Network Traffic.

The device allows Web UI and API access over non-secure network ports which exposes sensitive information such as user passwords.

This issue affects Automate VX: from 5.6.8161.21536 through 6.4.0.49.

Remedy

Crestron recommends updating to firmware version 6.4.1.8 or higher. The firmware version will disables the use of unsecure ports for the Web UI and API.

First published (updated )

CVE-2025-47419

Crestron Automate VXRecording

Risk 19

Severity

5.3

EPSS

0.04%

Infoleak

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Crestron Automate VX allows Functionality Misuse.

There is no visible indication when the system is recording and recording can be enabled remotely via a network API. This issue affects Automate VX: from 5.6.8161.21536 through 6.4.0.49.

Remedy

Crestron recommends updating to firmware version 6.4.1.8 or higher. The firmware version will adds a visual indication on the program video output when recording is started.

First published (updated )

CVE-2025-47418

Crestron Automate VXEnable Debug Images

Risk 17

Severity

5.1

EPSS

0.05%

Infoleak

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Crestron Automate VX allows Functionality Misuse.

When Enable Debug Images in Crestron Automate VX is active, snapshots of the captured video or portions thereof are stored locally on the system, and there is no visible indication that this is being done.

This issue affects Automate VX: from 5.6.8161.21536 through 6.4.0.49.

Remedy

Crestron recommends updating the software to firmware version 6.4.1.8 or higher. The firmware update will automatically disables the Enable Debug Images Mode on system startup and reboot (which occurs daily), or if manually disabled, whichever occurs first, and automatically deletes captured images in 24 hours. While active, a visual overlay is applied to the program video output indicating Debug Images Enabled.

First published (updated )

CVE-2025-47417

Trending

Crestron Automate VXUser Permissions on Network API

Remedy

Crestron Automate VXNon-Secure Access

Remedy

Crestron Automate VXRecording

Remedy

Crestron Automate VXEnable Debug Images

Remedy

Company

Resources

Contact