PT-2025-19990 · Crestron · Crestron Automate Vx

Published 2025-05-06 · Updated 2025-05-07 · CVE-2025-47419

Positive Technologies (AI Summary)

CVSS v4.0

10

Critical

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Name of the Vulnerable Software and Affected Versions Crestron Automate VX versions 5.6.8161.21536 through 6.4.0.49

Description The issue allows for the cleartext transmission of sensitive information, such as user passwords, due to the device allowing Web UI and API access over non-secure network ports. This exposes sensitive information to sniffing network traffic.

Recommendations For Crestron Automate VX versions 5.6.8161.21536 through 6.4.0.49, consider restricting access to the Web UI and API over non-secure network ports until a secure version is available. As a temporary workaround, disable non-secure access to minimize the risk of sensitive information exposure.

Fix

Cleartext Transmission of Sensitive Information

Weakness Enumeration

CWE-319

Related Identifiers

BDU:2025-05299

CVE-2025-47419

Affected Products

Crestron Automate Vx

References · 12

• https://security.crestron.com · Vendor Advisory
• https://crestron.com/Software-Firmware/Software/Automate-VX-Software/6-4-1-8 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2025-47419 · Security Note
• https://bdu.fstec.ru/vul/2025-05299 · Security Note
• https://t.me/latest_high_impact_cve/2294 · Telegram Post
• https://t.me/cvedetector/24650 · Telegram Post
• https://crestron.com/Software-Firmware/Software/Automate-VX-Software · Note
• https://crestron.com/release_notes/automate_vx_6.4.1.8_release_notes.pdf · Note
• https://github.com/advisories/GHSA-49xp-c6gp-qwww · Note
• https://twitter.com/cybercronai/status/1920135421947683192 · Twitter Post
• https://t.me/cvetracker/23215 · Telegram Post
• https://twitter.com/CVEnew/status/1919863466950852945 · Twitter Post