PT-2018-17046 · Crestron · Crestron Console

Cale Black + 1 · Published 2018-07-10 · Updated 2019-10-09 · CVE-2018-5553

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Crestron Console service versions 1.3384.00049.001 and lower

Description The issue concerns command injection that can be used to gain root-level access. This affects devices with default configuration, specifically DGE-100, DM-DGE-200-C, and TS-1542-C devices.

Recommendations For versions 1.3384.00049.001 and lower, update the firmware to a version higher than 1.3384.00049.001 to resolve the issue.

Exploit

Fix

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2018-5553

ZDI-18-936

Affected Products

Crestron Console

References · 5

• 🔥 https://blog.rapid7.com/2018/06/12/r7-2018-15-cve-2018-5553-crestron-dge-100-console-command-injection-fixed · Exploit
• https://zerodayinitiative.com/advisories/ZDI-18-936 · Security Note
• https://support.crestron.com/app/answers/answer_view/a_id/5471/~/the-latest-details-from-crestron-on-security-and-safety-on-the-internet#CVE%C2%AD-2018%C2%AD-5553 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-5553 · Security Note
• https://osv.dev/vulnerability/CVE-2018-5553 · Vendor Advisory