- Vendor / Project
- Crestron
- Product
- Multiple Products
- Date added
- Apr 15, 2022
- Due date
- May 6, 2022
- Known ransomware use
- Unknown
- CWEs
- CWE-79
Description
Multiple Crestron products are vulnerable to command injection via the file_transfer.cgi HTTP endpoint. A remote, unauthenticated attacker can use this vulnerability to execute operating system commands as root.
Required action
Apply updates per vendor instructions.