PT-2023-26409 · Crestron · Crestron 3-Series Control Systems

Published 2023-07-17 · Updated 2024-10-31 · CVE-2023-38405

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Crestron 3-Series Control Systems versions prior to 1.8001.0187

Description The issue allows an attacker to cause a crash by crafting and sending a specific BACnet packet.

Recommendations For Crestron 3-Series Control Systems versions prior to 1.8001.0187, update to version 1.8001.0187 or later to resolve the issue.

Fix

Allocation of Resources Without Limits

Weakness Enumeration

CWE-770

Related Identifiers

CVE-2023-38405

Affected Products

Crestron 3-Series Control Systems

References · 5

• https://osv.dev/vulnerability/CVE-2023-38405 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-38405 · Security Note
• https://t.me/cvenotify/100156 · Telegram Post
• https://crestron.com/release_notes/cp3n_1.8001.0187_release_notes.pdf · Note
• https://t.me/cibsecurity/66859 · Telegram Post