Solarwinds
12/22/20
More information
Threat:
Several technology companies recently disclosed a sophisticated supply chain attack that used malicious Solarwinds Orion software to compromise government and business networks across the world.
How is Crestron Affected:
Based on available information of the threat and a thorough review of our internal environment, we can share that this attack has not impacted Crestron. We have not used the Solarwinds software version reported to be compromised.
CVE-2020-16839: PASSWORD CHANGE VIA WEBSOCKET REQUEST
09/25/20
More information
Threat:
Crestron is aware of a vulnerability in the web application which allows the password to be changed by sending an unauthenticated Websocket request
Identifier:
This vulnerability has been assigned CVE identifier CVE-2020-16839.
How is Crestron Affected:
This vulnerability affects the following products:
DM-NVX-DIR-80, DM-NVX-DIR-160, DM-NVX-DIR-ENT
This vulnerability has been resolved in the current firmware upgrade. Crestron recommends upgrading devices with current firmware available on the product page.
Minimum firmware versions to address this vulnerability:
v.1.0.3.802
Resources:
For more information, please see release notes:
v.1.0.3.802
RIPPLE20: Treck TCP/IP Stack
06/29/20
More information
Threat:
Crestron is aware of a public report, known as “Ripple20” that details vulnerabilities found in the Treck TCP/IP stack. Crestron is issuing this advisory to provide notice of the reported vulnerabilities.
Identifier:
This vulnerability has been assigned multiple CVE identifiers. See list below.
How is Crestron Affected:
We have reviewed our product lines and confirmed with our vendors this reported vulnerability does not affect any Crestron products.
Assigned
CVE identifiers:
CVE-2018-15473: OpenSSH User Enumeration
05/22/20
More information
Threat:
Crestron is aware of OpenSSH through 7.7 is prone to a user enumeration vulnerability due to not delaying bailout for an invalid authenticating user until after the packet containing the request has been fully parsed, related to auth2-gss.c, auth2-hostbased.c, and auth2-pubkey.c.
Identifier:
This vulnerability has been assigned CVE identifier CVE-2018-15473.
How is Crestron Affected:
This vulnerability affects the following products: CP3, RMC3, CP3N, PRO3
Crestron 3-Series Control Systems now uses a customized version of OpenSSH. The Crestron version was modified to replace the cryptographic functions with NIST certified alternatives as well as to remove/modify vulnerable components. Crestron continues to monitor OpenSSH vulnerabilities to apply appropriate fixes.
Resources:
For more information, please see release notes:
v.1.601.0050
CVE-2019-16905: OpenSSH Integer Overflow
05/22/20
More information
Threat:
Crestron is aware of OpenSSH 7.7 through 7.9 and 8.x before 8.1, when compiled with an experimental key type, has a pre-authentication integer overflow if a client or server is configured to use a crafted XMSS key. This leads to memory corruption and local code execution because of an error in the XMSS key parsing algorithm.
NOTE: the XMSS implementation is considered experimental in all released OpenSSH versions.
Identifier:
This vulnerability has been assigned CVE identifier CVE-2019-16905
How is Crestron Affected:
Crestron products do not enable support for XMSS and, therefore, are not affected by this flaw.
CVE-1999-0524: ICMP Exploit
03/28/20
More information
Threat:
Crestron is aware of a vulnerability in which the ICMP protocol can send netmask and timestamp information to other hosts.
Identifier:
This vulnerability has been assigned CVE identifier CVE-1999-0524.
How is Crestron Affected:
This vulnerability affects the following products: PRO3, RMC3 and CP3.
Crestron recommends upgrading devices to current firmware available and turning ICMP OFF to mitgate risk.
CVE-2018-11228: Bash Shell Exploit
03/27/20
More information
Threat:
Crestron is aware of a vulnerability that allows unauthenticated, remote code execution with the Bash shell service in Crestron Toolbox Protocol.
Identifier:
This vulnerability has been assigned CVE identifier CVE-2018-11228
How is Crestron Affected:
This vulnerability affects the following products: TSW-1060, TSW-760, TSW-560, TSW-1060-NC, TSW-760-NC, and TSW-560-NC.
Crestron recommends that users update their firmware to v2.007.0060.001
CVE-2020-0796: Microsoft SMBv3 Remote Code Execution
03/16/20
More information
Threat:
Crestron is aware of a remote code execution vulnerability exists in the way that the Microsoft Server Message Block 3.1.1 (SMBv3) protocol handles certain requests, aka 'Windows SMBv3 Client/Server Remote Code Execution Vulnerability'.
Identifier:
This vulnerability has been assigned CVE identifier CVE-2020-0796.
How is Crestron Affected:
Crestron recommends users to set firewall rules to block open port 445 as they would any other Windows PC product for the following products below.
Products: UC-ENGINE, UC-ENGINE-SD, UC-ENGINE-SD-Z, CCS-UC-300, UC-M150-T, UC-M130-T, UC-M150-Z, UC-M130-Z, UC-M100-T, UC-B140-T, UC-B160-Z , UC-B160-T, UC-C160-T, UC-B140-Z, UC-C160-Z
Crestron has reviewed the vulnerability report and has confirmed that it does not affect any other shipping Crestron products.
CVE-2019-15126: KR00K Wi-Fi Vulnerability
03/09/20
More information
Threat:
Crestron is aware of a vulnerability that was discovered on certain Wi-Fi client devices. Specifically timed and handcrafted traffic can cause internal errors (related to state transitions) in a WLAN device that lead to improper layer 2 Wi-Fi encryption with a consequent possibility of information disclosure over the air for a discrete set of traffic, a different vulnerability than CVE-2019-9500, CVE-2019-9501, CVE-2019-9502, and CVE-2019-9503.
Identifier:
This vulnerability has been assigned CVE identifier CVE-2019-15126.
How is Crestron Affected:
Crestron has reviewed the vulnerability report against all shipping products and has confirmed that the AM-200, AM-300, and TSR-310, are not affected.
CVE-2020-0601: Microsoft Windows CryptoAPI Spoofing
02/14/20
More information
Threat:
Crestron is aware of a spoofing vulnerability exists in the way Microsoft Windows CryptoAPI (Crypt32.dll) validates Elliptic Curve Cryptography (ECC) certificates. An attacker could exploit the vulnerability by using a spoofed code-signing certificate to sign a malicious executable, making it appear the file was from a trusted, legitimate source. The user would have no way of knowing the file was malicious, because the digital signature would appear to be from a trusted provider. A successful exploit could also allow the attacker to conduct man-in-the-middle attacks and decrypt confidential information on user connections to the affected software
Identifier:
This vulnerability has been assigned CVE identifier CVE-2020-0601
How is Crestron Affected:
Updates to Crestron Fusion Cloud VM services are currently being rolled out and will be completed by February 15th, 2020.
Crestron is working with Microsoft to deploy a timely update for our products affected below. Crestron will provide an update as soon as its available.
Products: UC-ENGINE, UC-ENGINE-SD, UC-ENGINE-SD-Z, CCS-UC-300, UC-M150-T, UC-M130-T, UC-M150-Z, UC-M130-Z, UC-M100-T, UC-B140-T, UC-B160-Z , UC-B160-T, UC-C160-T, UC-B140-Z, UC-C160-Z
Crestron RL2 devices should be upgraded from Windows 7 to Windows 10, please see link below.
Crestron has reviewed the vulnerability report and has confirmed that it does not affect any other shipping Crestron products.
|<
<
1 2 3 4 5
>
>|
Pages: 1 of 5