PT-2025-35721 · Crestron · Am-3200+12

Frank Slezak · Published 2025-09-03 · Updated 2025-09-03 · CVE-2025-47421

Positive Technologies (AI Summary)

CVSS v4.0

8.6

High

Base vector

AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions CRESTRON TOUCHSCREENS x70 versions 3.001.0031.001 through 3.001.0034.001

Description An improper neutralization of argument delimiters in a command ('Argument Injection') vulnerability exists in CRESTRON TOUCHSCREENS x70. A specially crafted SCP command sent via SSH login string can allow a valid administrator user to gain privileged operating system access on the device. Affected product models include TSW-x70, TSW-x60, TST-1080, AM-3000/3100/3200, Soundbar VB70, HD-PS622/621/402, HD-TXU-RXU-4kZ-211, and HD-MDNXM-4KZ-E.

Recommendations Update to a version later than 3.001.0034.001.

Fix

Argument Injection

Weakness Enumeration

CWE-88

Related Identifiers

CVE-2025-47421

Affected Products

Am-3000

Am-3100

Am-3200

Crestron Touchscreens X70

Hd-Mdnxm-4Kz-E

Hd-Ps402

Hd-Ps621

Hd-Ps622

Hd-Txu-Rxu-4Kz-211

Soundbar Vb70

Tst-1080

Tsw-X60

Tsw-X70

References · 6

• https://security.crestron.com · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-47421 · Security Note
• https://https//www.crestron.com/Software-Firmware/Firmware/Touchpanels/TS-770-TS-1070-TSS-770-TSS-1070-TSW-570/3-002-0040-001 · Patch
• https://twitter.com/CVEnew/status/1963275352001663139 · Twitter Post
• https://https//www.crestron.com/release_notes/tsw-xx70_3.002.0040.001_release_notes.pdf · Note
• https://t.me/CVEtracker/31601 · Telegram Post