PT-2019-16765 · Crestron · Crestron Am-100

Published 2019-01-18 · Updated 2020-08-24 · CVE-2019-3910

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

Name of the Vulnerable Software and Affected Versions Crestron AM-100 versions prior to 1.6.0.2

Description The issue concerns an authentication bypass in the web interface's return.cgi script, allowing unauthenticated remote users to access certain administrator functionality. This includes configuring update sources and rebooting the device.

Recommendations For versions prior to 1.6.0.2, update to firmware version 1.6.0.2 or later to resolve the issue. As a temporary workaround, consider restricting access to the web interface to minimize the risk of exploitation.

Exploit

Fix

Related Identifiers

CVE-2019-3910

Affected Products

Crestron Am-100

References · 3

• 🔥 https://tenable.com/security/research/tra-2019-02 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2019-3910 · Security Note
• https://osv.dev/vulnerability/CVE-2019-3910 · Vendor Advisory