Description (CNA)
Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') vulnerability in CRESTRON TOUCHSCREENS x70 allows Argument Injection.This issue affects TOUCHSCREENS x70: from 3.001.0031.001 through 3.001.0034.001. A specially crafted SCP command sent via SSH login string can lead a valid administrator user to gain Privileged Operating System access on the device. Following Products Models are affected: TSW-x70 TSW-x60 TST-1080 AM-3000/3100/3200 Soundbar VB70 HD-PS622/621/402 HD-TXU-RXU-4kZ-211 HD-MDNXM-4KZ-E *Note: additional firmware updates will be published once made available
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| CRESTRON / TOUCHSCREENS x70 | affected 3.001.0031.001 before 3.001.0034.001 |
CWE
CWE-88
References
- https://security.crestron.com
- https://https://www.crestron.com/Software-Firmware/Firmware/Touchpanels/TS-770-TS-1070-TSS-770-TSS-1070-TSW-570/3-002-0040-001
- https://https://www.crestron.com/release_notes/tsw-xx70_3.002.0040.001_release_notes.pdf
ADP enrichment
No English description supplied.
No references supplied.