PT-2022-6277 · Crestron · Crestron Airmedia Windows Application

Published 2022-09-13 · Updated 2022-09-15 · CVE-2022-34100

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Crestron AirMedia Windows Application version 4.3.1.39

Description A vulnerability in the Crestron AirMedia Windows Application allows a low-privileged user to gain a SYSTEM level command prompt. This is achieved by pre-staging a file structure prior to the installation of a trusted service executable and changing permissions on that file structure during a repair operation. The issue is related to incorrect privilege handling, which can be exploited by a remote attacker to gain access to a command line with SYSTEM level privileges.

Recommendations For version 4.3.1.39, consider restricting access to the repair operation functionality until a patch is available. As a temporary workaround, avoid using the Crestron AirMedia Windows Application for sensitive operations that require elevated privileges. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-275

Related Identifiers

BDU:2023-00709

CVE-2022-34100

Affected Products

Crestron Airmedia Windows Application

References · 7

• https://bdu.fstec.ru/vul/2023-00709 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2022-34100 · Security Note
• https://osv.dev/vulnerability/CVE-2022-34100 · Vendor Advisory
• https://crestron.com/release_notes/airmedia_windows_installer_release_notes_5.5.1.84.pdf · Vendor Advisory
• https://crestron.com/Security/Security_Advisories · Vendor Advisory
• https://vuldb.com/ru/?id.208577 · Note
• https://t.me/cvenotify/36255 · Telegram Post