PT-2026-37084 · Crestron · Crestron Devices

Eugene Lim · Published 2026-05-05 · Updated 2026-05-08 · CVE-2026-7865

Positive Technologies (AI Summary)

CVSS v4.0

7.4

High

Base vector

AV:N/AC:H/AT:N/PR:H/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Crestron devices (affected versions not specified)

Description A hidden console command contains a command injection flaw occurring when control characters are passed to its second argument. This issue exists in the way the console command is passed to the popen() function. Authenticated attackers with SSH console access can exploit this to execute underlying operating system commands.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Argument Injection

Weakness Enumeration

CWE-88

Related Identifiers

CVE-2026-7865

Affected Products

Crestron Devices

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2026-7865 · Security Note
• https://crestron.com/Software-Firmware/Firmware/Touchpanels/TS-770-TS-1070-TSS-770-TSS-1070-TSW-570/3-003-0015-001 · Patch
• https://t.me/cveNotify/162551 · Telegram Post
• https://t.me/CVEtracker/52767 · Telegram Post
• https://crestron.com/release_notes/tsw-xx70_3.003.0015.001_release_notes.pdf · Note
• https://twitter.com/spaceraccoonsec/status/2052764024052564087 · Twitter Post