All vulnerabilities
CVE-2019-3929

Crestron Multiple Products Command Injection Vulnerability

Crestron Multiple Products
Open in ThreatlineRecord JSON
CVSS
9.8Critical
ExploitationExploited in the wildAdded to KEV 15 Apr 2022CISA KEV
Exploit odds (EPSS)99.0%Chance of exploitation activity in the next 30 days, higher than 99.9% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed inNone listedNo source names a fixed version. Check the vendor advisory below
Federal deadline6 May 2022Remediation due date for US federal agenciesCISA KEV
CISA required actionApply updates per vendor instructions. CISA KEV

What fixes it

No source in this snapshot names a fixed version. The vendor advisories under References are the place to check.

Timeline

  1. 30 Apr 2019Exploit code publicMetasploit
  2. 30 Apr 2019, 20:21 UTCPublishedCVE List
  3. 15 Apr 2022Added to CISA KEVCISA KEV

Public exploit code and templates 4

  • Exploit moduleBarco WePresent file_transfer.cgi Command Injection 30 Apr 2019Metasploit
  • Remote exploitBarco WePresent - file_transfer.cgi Command Injection (Metasploit) 15 Jan 2020Exploit-DB
  • Webapps exploitCrestron AM/Barco wePresent WiPG/Extron ShareLink/Teq AV IT/SHARP PN-L703WA/Optoma WPS-Pro/Blackbox HD WPS/InFocus LiteShow - Remote Command Injection 3 May 2019Exploit-DB
  • Scanner templateBarco/AWIND OEM Presentation Platform - Remote Command InjectionNuclei

Listed so defenders can prioritize. Threatline links to the source and does not host exploit code.

Description

Multiple Crestron products are vulnerable to command injection via the file_transfer.cgi HTTP endpoint. A remote, unauthenticated attacker can use this vulnerability to execute operating system commands as root.

Text from CVE List

Affected versions 11

  • Crestron AirMedia, Barco WePresent, Extron ShareLink, Teq AV IT WIPS710, SHARP PN-L703WA, Optoma WPS-Pro, Blackbox HD WPS, InFocus LiteShow3, and InFocus LiteShow4.affected: Crestron AM-100 firmware 1.6.0.2CVE List
  • Crestron AirMedia, Barco WePresent, Extron ShareLink, Teq AV IT WIPS710, SHARP PN-L703WA, Optoma WPS-Pro, Blackbox HD WPS, InFocus LiteShow3, and InFocus LiteShow4.affected: Crestron AM-101 firmware 2.7.0.1CVE List
  • Crestron AirMedia, Barco WePresent, Extron ShareLink, Teq AV IT WIPS710, SHARP PN-L703WA, Optoma WPS-Pro, Blackbox HD WPS, InFocus LiteShow3, and InFocus LiteShow4.affected: Barco wePresent WiPG-1000P firmware 2.3.0.10CVE List
  • Crestron AirMedia, Barco WePresent, Extron ShareLink, Teq AV IT WIPS710, SHARP PN-L703WA, Optoma WPS-Pro, Blackbox HD WPS, InFocus LiteShow3, and InFocus LiteShow4.affected: Barco wePresent WiPG-1600W before firmware 2.4.1.19CVE List
  • Crestron AirMedia, Barco WePresent, Extron ShareLink, Teq AV IT WIPS710, SHARP PN-L703WA, Optoma WPS-Pro, Blackbox HD WPS, InFocus LiteShow3, and InFocus LiteShow4.affected: Extron ShareLink 200/250 firmware 2.0.3.4CVE List
  • Crestron AirMedia, Barco WePresent, Extron ShareLink, Teq AV IT WIPS710, SHARP PN-L703WA, Optoma WPS-Pro, Blackbox HD WPS, InFocus LiteShow3, and InFocus LiteShow4.affected: Teq AV IT WIPS710 firmware 1.1.0.7CVE List
  • Crestron AirMedia, Barco WePresent, Extron ShareLink, Teq AV IT WIPS710, SHARP PN-L703WA, Optoma WPS-Pro, Blackbox HD WPS, InFocus LiteShow3, and InFocus LiteShow4.affected: SHARP PN-L703WA firmware 1.4.2.3CVE List
  • Crestron AirMedia, Barco WePresent, Extron ShareLink, Teq AV IT WIPS710, SHARP PN-L703WA, Optoma WPS-Pro, Blackbox HD WPS, InFocus LiteShow3, and InFocus LiteShow4.affected: Optoma WPS-Pro firmware 1.0.0.5CVE List
  • Crestron AirMedia, Barco WePresent, Extron ShareLink, Teq AV IT WIPS710, SHARP PN-L703WA, Optoma WPS-Pro, Blackbox HD WPS, InFocus LiteShow3, and InFocus LiteShow4.affected: Blackbox HD WPS firmware 1.0.0.5CVE List
  • Crestron AirMedia, Barco WePresent, Extron ShareLink, Teq AV IT WIPS710, SHARP PN-L703WA, Optoma WPS-Pro, Blackbox HD WPS, InFocus LiteShow3, and InFocus LiteShow4.affected: InFocus LiteShow3 firmware 1.0.16CVE List
  • Crestron AirMedia, Barco WePresent, Extron ShareLink, Teq AV IT WIPS710, SHARP PN-L703WA, Optoma WPS-Pro, Blackbox HD WPS, InFocus LiteShow3, and InFocus LiteShow4.affected: and InFocus LiteShow4 2.0.0.7CVE List

References 4