{"id":"CVE-2019-3929","kind":"vulnerability","aliases":["CVE-2019-3929"],"related":[],"title":"Crestron Multiple Products: Crestron Multiple Products Command Injection Vulnerability","description":"The Crestron AM-100 firmware 1.6.0.2, Crestron AM-101 firmware 2.7.0.1, Barco wePresent WiPG-1000P firmware 2.3.0.10, Barco wePresent WiPG-1600W before firmware 2.4.1.19, Extron ShareLink 200/250 firmware 2.0.3.4, Teq AV IT WIPS710 firmware 1.1.0.7, SHARP PN-L703WA firmware 1.4.2.3, Optoma WPS-Pro firmware 1.0.0.5, Blackbox HD WPS firmware 1.0.0.5, InFocus LiteShow3 firmware 1.0.16, and InFocus LiteShow4 2.0.0.7 are vulnerable to command injection via the file_transfer.cgi HTTP endpoint. A remote, unauthenticated attacker can use this vulnerability to execute operating system commands as root.","summary":"Multiple Crestron products have a command injection flaw in the file_transfer.cgi HTTP endpoint. A remote attacker without credentials can run operating system commands as root.","severity":"critical","cvss":10.0,"epss":0.98952,"exploited":true,"exploited_at":"2022-04-15T00:00:00+00:00","products":[{"name":"Crestron Multiple Products","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["building-automation","crestron","embedded","exploited","infrastructure"],"not_affected_if":["no-crestron-devices"],"how_to_check":null,"fix":"Apply the updates from Crestron per vendor instructions; the sources do not name the fixed versions.","status":"open","published_at":"2019-04-30T21:29:00+00:00","first_seen_at":"2026-10-23T19:11:52+00:00","triaged_at":"2026-10-23T21:17:49+00:00","updated_at":"2026-10-23T21:57:35+00:00","category":"infrastructure","confidence":0.8,"triage":{"at":"2026-10-23T21:17:49Z","model":"claude-haiku-5-5","output":{"fix":"Apply the updates from Crestron per vendor instructions; the sources do not name the fixed versions.","reach":"internet","impact":"high","summary":"Multiple Crestron products have a command injection flaw in the file_transfer.cgi HTTP endpoint. A remote attacker without credentials can run operating system commands as root.","category":"infrastructure","who_cares":["crestron","building-automation","embedded"],"confidence":0.8,"needs_auth":"no","worst_case":"Unauthenticated remote attacker gets root command execution on the device.","analyst_note":"Find the affected Crestron model list and fixed firmware versions from the vendor advisory, and a way to detect exposure (file_transfer.cgi reachable).","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["no-crestron-devices"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.00045,"input_tokens":2852,"output_tokens":329,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-100':54C '-101':59C '-2019':11A,14A '-3929':12A,15A '1.0.0.5':99C,104C '1.0.16':108C '1.1.0.7':87C '1.4.2.3':93C '1.6.0.2':56C '1000p':66C '1600w':73C '2.0.0.7':112C '2.0.3.4':81C '2.3.0.10':68C '2.4.1.19':76C '2.7.0.1':61C '200/250':79C 'attack':41B,126C 'autom':21B 'av':83C 'barco':62C,69C 'blackbox':100C 'build':20B 'building-autom':19B 'command':7A,31B,48B,116C,135C 'credenti':43B 'crestron':1A,4A,16A,22B,27B,52C,57C 'cve':10A,13A 'embed':23B 'endpoint':38B,122C 'execut':132C 'exploit':24B 'extron':77C 'file_transfer.cgi':36B,120C 'firmwar':55C,60C,67C,75C,80C,86C,92C,98C,103C,107C 'flaw':33B 'hd':101C 'http':37B,121C 'infocus':105C,110C 'infrastructur':25B 'inject':8A,32B,117C 'l703wa':91C 'liteshow3':106C 'liteshow4':111C 'multipl':2A,5A,26B 'multiple':17A 'oper':46B,133C 'optoma':94C 'pn':90C 'pn-l703wa':89C 'pro':97C 'product':3A,6A,28B 'products':18A 'remot':40B,124C 'root':50B,137C 'run':45B 'sharelink':78C 'sharp':88C 'system':47B,134C 'teq':82C 'unauthent':125C 'use':128C 'via':118C 'vulner':9A,114C,130C 'wepres':63C,70C 'wipg':65C,72C 'wipg-1000p':64C 'wipg-1600w':71C 'wips710':85C 'without':42B 'wps':96C,102C 'wps-pro':95C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2019-04-30T21:29:00+00:00","kev":{"dateAdded":"2022-04-15","dueDate":"2022-05-06","requiredAction":"Apply updates per vendor instructions.","knownRansomwareCampaignUse":"Unknown"},"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"nvd@nist.gov","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2019-3929","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2019-3929","severity":null,"published_at":"2022-04-15T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:52+00:00","fetched_at":"2026-10-25T10:39:06+00:00","note":null},{"source":"epss","external_id":"CVE-2019-3929","url":"https://api.first.org/data/v1/epss?cve=CVE-2019-3929","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-23T19:13:45+00:00","fetched_at":"2026-10-23T19:13:45+00:00","note":null},{"source":"nvd","external_id":"CVE-2019-3929","url":"https://nvd.nist.gov/vuln/detail/CVE-2019-3929","severity":null,"published_at":"2019-04-30T21:29:00+00:00","modified_at":"2026-06-17T02:35:52+00:00","first_seen_at":"2026-10-23T21:57:35+00:00","fetched_at":"2026-10-23T21:57:35+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}