PT-2025-36735 · Ctpd+3 · Ctpd+3

Published 2025-09-09 · Updated 2025-09-09 · CVE-2025-47416

Positive Technologies (AI Summary)

CVSS v4.0

5.9

Medium

Base vector

AV:N/AC:H/AT:N/PR:H/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions: TSW-760 versions prior to 3.001.0031.001 TSW-1060 versions prior to 3.001.0031.001

Description: A vulnerability exists in the ConsoleFindCommandMatchList function within libsymproc.so imported by ctpd that may allow an attacker to execute an attacker-defined file due to prioritization within the ConsoleFindCommandMatchList. The ConsoleFindCommandMatchList enumerates the /dev/shm/symproc/c directory in alphabetical order to identify console commands, inferring permission levels from integer values in the file names.

Recommendations: Update TSW-760 to version 3.001.0031.001 or later. Update TSW-1060 to version 3.001.0031.001 or later.

Fix

Weakness Enumeration

CWE-697

Related Identifiers

CVE-2025-47416

Affected Products

Tsw-1060

Tsw-760

Ctpd

Libsymproc.So

References · 5

• https://security.crestron.com · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-47416 · Security Note
• https://crestron.com/Software-Firmware/Firmware/Touchpanels/TS-770-TS-1070-TSS-770-TSS-1070-TSW-570/3-002-0040-001 · Patch
• https://t.me/CVEtracker/32076 · Telegram Post
• https://twitter.com/CVEnew/status/1965418316077658544 · Twitter Post