CVE-2019-3910: Authentication Bypass - This vulnerability has been resolved in the current firmware and can be downloaded on the product page. Minimum firmware version to address this vulnerability: 2.7.0 (AM-101) and 1.6.0 (AM-100). Affected Devices:

• AM-101
• AM-100

Minimum firmware version to address this vulnerability: v2.001.0037.001. Affected Devices:

• TSW-1060
• TSW-760
• TSW-560
• TSW-1060-NC
• TSW-760-NC
• TSW-560-NC

CVE-2018-11228

August 2018 Crestron Vulnerability Report

Minimum firmware version to address this vulnerability: v2.001.0037.001. Affected Devices:

• TSW-1060
• TSW-760
• TSW-560
• TSW-1060-NC
• TSW-760-NC
• TSW-560-NC

CVE-2018-11229

August 2018 Crestron Vulnerability Report

CVE-2018-10630

August 2018 Crestron Vulnerability Report

Minimum firmware version to address this vulnerability: v2.001.0037.001. Affected Devices:

• TSW-1060
• TSW-760
• TSW-560
• TSW-1060-NC
• TSW-760-NC
• TSW-560-NC

CVE-2018-13341

August 2018 Crestron Vulnerability Report

This vulnerability has been resolved in the current firmware and can be downloaded on the product page.

Minimum firmware version to address this vulnerability: 2.7.0 (AM-101) and 1.6.0 (AM-100). Affected Devices:

• AM-101
• AM-100

This vulnerability has been resolved in the current firmware and can be downloaded on the product page.

Minimum firmware version to address this vulnerability: 2.7.0 (AM-101) and 1.6.0 (AM-100)Affected Devices:

• AM-101
• AM-100

This vulnerability has been resolved in the current firmware and can be downloaded on the product page.

Minimum firmware versions to address this vulnerability:

• TSW-X60 Series use FW 2.0001.0037.001 or late
• TSW-X52 Series use FW 1.004.0007 or later

Affected Devices:

• TSW-1060
• TSW-760
• TSW-560
• TSW-1060-NC
• TSW-760-NC
• TSW-560-NC
• TSW-552
• TSW-752
• TSW-1052
• TSR-302
• TST-602
• TST-902
• TSW-732
• TSS-752
• DMC-STR

Additional products are being tested.

This vulnerability has been resolved in the current firmware and can be downloaded on the product page.

Minimum firmware versions to address this vulnerability:

• TSW-X60 Series use FW 2.0001.0037.001 or later
• TSW-X52 Series use FW 1.004.0007 or later

Affected Devices:

• TSW-1060
• TSW-760
• TSW-560
• TSW-1060-NC
• TSW-760-NC
• TSW-560-NC
• TSW-552
• TSW-752
• TSW-1052
• TSR-302
• TST-602
• TST-902
• TSW-732
• TSS-752
• DMC-STR

Additional products are being tested.

This vulnerability has been resolved in the current firmware and can be downloaded on the product page.

Minimum firmware version to address this vulnerability: 1.3384.00059.001

Affected Devices:

• DGE-100
• TS-1542-C
• DM-DGE-200-C

Crestron's DM-NVX had a password vulnerability in firmware version 1.3547.00018 and earlier. Due to this vulnerability passwords were authenticated with only eight (8) characters. Therefore, characters after the first eight (8) were discarded and ignored. After upgrading it is recommended to resubmit or change the password for user accounts.

If attempting to downgrade from 1.3626.00053 to an earlier version of firmware, the DM-NVX will be automatically restored due to this vulnerability.

1. Crestron's Cloud Services which include Fusion Cloud, the Crestron Cloud Provisioning Tool and MyCrestron have been patched by Microsoft as of 1/4/2018. For more details on the patch, see: https://azure.microsoft.com/en-us/blog/securing-azure-customers-from-cpu-vulnerability/
2. On Premise Servers running Crestron Fusion should be patched according to Microsoft recommendations. Crestron Fusion itself does not require an update.
3. 3 Series Processors are not known to be affected by Meltdown.
4. 2 Series processors are not affected by Meltdown as they do not use ARM, Intel or AMD based components.
5. These devices (Mercury, DGE-100, DGE-200, TS-1542, DMPS-4K-250, DMPS-4K-350 and DM-TXRX-100-STR) have the potential to be affected by a variant of Meltdown. However, as stated by ARM, it is not believed that software mitigations for this issue are necessary. Please download the ARM’s Cache Speculation Side-channels whitepaper for more details.
6. All TSW Series, TST Series, TSR Series, TPMC-4 Series and TPMC-9 Series are not affected by Meltdown.
7. No DigitalMedia products are known to be affected by Meltdown.
8. No Audio Products are known to be affected by Meltdown.
9. AirMedia (AM-100/101) is not known to be vulnerable by Meltdown.
10. All Lighting and Shade specific products are not affected by Meltdown.
11. Affected Conferencing Products include CCS-UC-CODEC-100, CCS-UC-CODEC-200, Crestron SR, and Mercury. Because of additional security implementations on these devices we believe this to be a low risk issue. Crestron is working with Microsoft to provide patches on these devices.

Products not listed here are pending additional review or discontinued. Crestron will be providing additional information and patches as they become available.

Securing Azure customers from CPU vulnerability

ARM’s Cache Speculation Side-channels whitepaper

1. Crestron's Cloud Services which include Fusion Cloud, the Crestron Cloud Provisioning Tool and MyCrestron are currently affected as no patches have been published by Microsoft to specifically mitigate the Spectre Vulnerability. For more details, see: https://azure.microsoft.com/en-us/blog/securing-azure-customers-from-cpu-vulnerability/
2. On Premise Servers running Crestron Fusion should be patched according to Microsoft recommendations. Crestron Fusion itself does not require an update.
3. Affected Control Systems include the PRO3, AV3, CP3, CP3N, RMC3, FT-TSC600, PYNG-HUB, TSCW-730, ZUM-FLOOR-HUB DIN-AP3MEX and DIN-AP3. This vulnerability is considered low risk for processors as it’s a second level vulnerability (requires system access which is traditionally not available). It is recommended that you follow Crestron’s Secure Deployment Guidelines to reduce exposure (OLH 5571). The MC3 and TPCS are not affected by Spectre.
4. 2 Series processors are not known to be affected by Spectre as they do not use ARM, Intel or AMD based components.

5. Affected Interfaces include the TSW-1060, TSW-760, TSW-560, TSW-1052, TSW-752, TSW-552, TSS-752, TSW-732, TSW-1050, TSW-750, TSW-730, TSW-550, TSR-302, TSR-310, TST-902, TST-602, DGE-100, DGE-200, TS-1542, and FT-TS600. This vulnerability is considered low risk for interfaces as it’s a second level vulnerability (requires system access which is traditionally not available). It is recommended that you follow Crestron’s Secure Deployment Guidelines to reduce exposure. Additionally to minimize exposure, it would be recommended to avoid implementing the Chrome browser in touchpanel projects.

6. TPMC-4 Series and TPMC-9 Series are not affected by Spectre.

7. Affected DigitalMedia products include NVX, DMPS3 Series, DM-STR, DM-MD64x64, DM-MD128x128 and DM-TXRX-100-STR. This vulnerability is considered low risk for DigitalMedia as it’s a second level vulnerability (requires system access which is traditionally not available). It is recommended that you follow Crestron’s Secure Deployment Guidelines to reduce exposure.

8. Audio Products affected by Spectre include the DSP-1280, DSP-1281, DSP-1282, DSP-1283, DSP-860, AMP-8075 and AMP-8150. This vulnerability is considered low risk for Audio Products as it’s a second level vulnerability (requires system access which is traditionally not available). It is recommended that you follow Crestron’s Secure Deployment Guidelines to reduce exposure.

9. AirMedia (AM-100/101) is not known to be vulnerable by Spectre.

10. All Lighting and Shade specific products are not affected by Spectre.

11. Affected Conferencing Products include CCS-UC-CODEC-100, CCS-UC-CODEC-200, Crestron SR, and Mercury. Because of additional security implementations on these devices we believe this to be a low risk issue. Crestron is working with Microsoft to provide patches on these devices.

Products not listed here are pending additional review or discontinued. Crestron will be providing additional information and patches as they become available.

CVE-2017-5753

CVE-2017-5715

Crestron’s Secure Deployment Guidelines

Securing Azure customers from CPU vulnerability

Crestron is aware of a flaw in the authentication model of the following products:

TSW-560, TSW-560P, TSW-760, TSW-1060, TSW-560-NC, TSW-760-NC, TSW-1060-NC running the following versions 1.002.0016.001, 1.002.0028.001, 1.003.0052.001.

A hacker can gain access to the device configuration pages using invalid credentials. It should be noted that the vulnerability only allows access to the configuration of the device and thus possibly render the device inoperable or inaccessible.

Crestron has posted an updated version of the firmware to address this problem:

• If you are running version 1.002.0016 or 1.002.0028, please update to version 1.002.0029.
• If you are running version 1.003.0052, please update to version 1.003.0054.

If you previously disabled the webserver to mitigate this issue you may re-enable it using the command WEBSERVER ON, followed by a REBOOT.

• All exposed parameters on the DM NVX are Read Only, so an attacker is limited
• The risk can be eliminated by blocking UDP traffic on ports 161 and 162

The only Crestron device that currently exposes a Bluetooth interface is the Crestron Mercury Tabletop Conference System.

Mercury uses a BlueTooth module which incorporates a proprietary operating system (not Android, iOS, Windows or Linux) and therefore is not susceptible to the BlueBorne attack. Furthermore, all Bluetooth profiles are kept inactive during normal operation of the device, requiring explicit user intervention to enable paring and/or discovery to the device. As such, Mercury is not vulnerable to the BlueBorne attack vector.

It has been reported that there several vulnerabilities in the WiFi Protected Access II Protocol (WPA2).

The vulnerabilities make it possible for attackers to eavesdrop on WiFi traffic.

Please see the following CVE reports for additional information: CVE-2017-13077, CVE-2017-13078, CVE-2017-13079, CVE-2017-13080, CVE-2017-13081, CVE-2017-13082, CVE-2017-13084, CVE-2017-13086, CVE-2017-13087, and CVE-2017-13088.

This vulnerability is a protocol level vulnerability and as such affects nearly all correct implementations of the firmware.

The following devices are affected:

• CEN-WAP-1500
• CEN-WAP-ABG-1G
• CEN-WAP-ABG-CM
• TSR-302 - Resolved in Version 1.004.0007
• TST-602 - Resolved in Version 1.004.0007
• TST-902 - Resolved in Version 1.004.0007

Other Crestron WiFi products do not support WPA2 and as such are not affected.

If any of the CEN-WAP products are used with non-Crestron products, all unencrypted information should be considered at risk. Use HTTPS and other secure protocols until a fix is available.

Most traffic between the TSR-302, TST-602, TST-902 and the control system is over Crestron Extended Range 2.4 GHz RF (ER) and is thus unaffected. However, WiFi communications are used for some additional functions (such as video playback, intercom, etc.) and could be vulnerable. Crestron is actively working towards a fix.

If you are using a non-Crestron WAP you should also check with the vendor for updates.

A notable risk is that the following UI Applications use direct connections and could be intercepted and potentially spoofed:

• Media Player Object
• All Pyng Objects
• TV Presets Object

Two possible mitigations exist:

1. Remove the UI Applications from devices.
2. Disable WiFi on the Remotes. This will allow the UI Applications to still run but will disable other features (such as streaming video, intercom, graphics). Note that performance of the applications will also be affected.

It is recommended that all installations follow the Secure Deployment Guide found in Online Help ID 5571. This will enable additional encryption on the device. This will not remove the risk noted regarding the UI Applications by itself.

There are several vulnerabilities in Microsoft's implementation of SMBv1 on Windows. Microsoft addressed these in Microsoft Security Bulletin MS17-010 in March 2017. This bulletin refers to the following CVE identifiers: CVE-2017-0143, CVE-2017-0144, CVE-2017-0145, CVE-2017-0146, CVE-2017-0147, and CVE-2017-0148

The most severe of the vulnerabilities could allow remote code execution if an attacker sends specially crafted messages to a Microsoft Server Message Block 1.0 (SMBv1) server. SMB is a protocol mainly used for providing shared access to files and devices between nodes on a network.

Platforms not affected

Products running Windows CE 6 and Windows Embedded Compact 7 are not affected by the WannaCry malware package.

PRO3, CP3, CP3N, AV3, DMPS 3-Series (all models), DM-64X64, DM-128X128, RMC3, DIN-AP3, TSW-550, TSW-750, TSW-1050, TSM-730

• Only code signed with Crestron certificates can execute on these devices.
• These devices cannot execute x86 native code and so are not vulnerable to the WannaCry malware.
• The SMB file server is not enabled and so they are not vulnerable to the original ETERNALBLUE exploit.
• NOTE: It is not clear that the vulnerability exists in the Embedded Compact SMB implementation in the first place but as noted it is disabled anyway.

TPMC-4SM, TPMC-9, TST-600

• Only code signed with Crestron certificates can execute on these devices.
• These devices cannot execute x86 native code and so are not vulnerable to the WannaCry malware.
• The SMB ports are open but there is no notice of this implementation being vulnerable to the original ETERNALBLUE exploit.

MC3, TPCS-4SM

• Only code signed with Crestron certificates can execute on these devices.
• These devices cannot execute x86 native code and so are not vulnerable to the WannaCry malware.

Platforms potentially affected

Crestron also has devices using XP Embedded and Windows Embedded Standard 7.

DGE-2, DGE-1, TPMC-V12, TPMC-V15

• These products have the SMB ports closed by default and so are not vulnerable under normal installation.
• In the event the device does become infected; a reboot will clean it up.
• Please install the following update service pack which includes Microsoft KB4012598
  • DGE-1 Use dge-1-osp_1.1.10.zip or higher
  • DGE-2 Use dge-2_1.01.10.puf or higher
  • TPMC-V12/15 Use tpmc-v12_tpmc-v15_1.01.008.puf or higher

TPMC-8X-GA

TPMC-8X-GA Use tpmc-8x-ga-osp_1.1.10.zip or higher.

• NOTE: This product has SMB ports open by default and should be considered at risk.
• In the event the devices does become infected, a reboot will clean it up.
• Please install the following updated service pack which includes Microsoft KB4012598.

TPMC-8X, TPMC-8L

• NOTE: This product has SMB ports open by default and should be considered at risk.
• In the event the devices does become infected, a reboot will clean it up.
• Please install the following updated service pack which forces the SMB ports closed regardless of any other settings.
  • Upgrade firmware to version 2.00.02.219 or above. 2.00.02.221 is the latest release at this writing.
  • Install new service pack tpmc-8x-tpmc-8l-firewall_1.0.0.zip.
  • Ensure firewall is enabled using the console command: FIREWALL

ADMS, ADMS-BR, ADMS-G2

These products have the SMB ports closed by default and so are not vulnerable under default installation. If file sharing options are enabled the device should be considered at risk.

Crestron RL (Version 1 and 2)

• Crestron RL products disallow arbitrary applications to be executed and so are not vulnerable.
• These products have the SMB ports closed by default and so are not vulnerable under normal installation.
• Notwithstanding these protections, Microsoft has provided a security update for Crestron RL products – https://techcommunity.microsoft.com/t5/Skype-for-Business-Blog/Skype-for-Business-15-15-9-Security-Update-for-Crestron-RL/ba-p/70432
• This has been posted in CCS-UC-200 ver. 15.15.09 and CCS-UC-100 ver. 15.15.09

CEN-FUSION-SERVER-R330, CEN-FUSION-RVS-R310, CEN-FUSION-R320, CEN-RVS-R210, CEN-RVS-R320

Please follow Microsoft guidance for Windows Server Products: https://blogs.technet.microsoft.com/msrc/2017/05/12/customer-guidance-for-wannacrypt-attacks/

NOTE: No other current Crestron products have been found to be affected by the WannaCry malware.

Microsoft Security Response Center

Skype for Business 15.15.9 Security Update for Crestron RL, Polycom CX8000, and SMART Room System

Customer Guidance for WannaCrypt attacks

As per TA14-290A, all systems and applications utilizing the Secure Socket Layer (SSL) 3.0 with cipher-block chaining (CBC) mode ciphers may be vulnerable. However, the POODLE (Padding Oracle On Downgraded Legacy Encryption) attack demonstrates this vulnerability using web browsers and web servers, which is one of the most likely exploitation scenarios.

Later, this vulnerability was extended to certain TLS 1.0 and TLS 1.1 implementations.

1. The most likely exploitation is via web browsers and servers, which is not a high use case on Crestron equipment. In addition, the exploitation is most commonly implemented as a Man-in-the-Middle attack which is also less likely given the way most Crestron systems are put together.
2. Crestron has deprecated support for SSL 3.0 and relies only on TLS which does not have this vulnerability. The console command "SSL" supports the following options: TLSSSL, TLSONLY, TLS1.2ONLY.
3. Crestron does implement the protocol extension, TLS_FALLBACK_SCSV, which prevents MITM attackers from being able to force a protocol downgrade.
4. Crestron's implementation of TLS 1.0 and TLS 1.1 was proven not to expose this vulnerability using the Qualys SSL Labs SSL Server test.

Alert (TA14-290A) SSL 3.0 Protocol Vulnerability and POODLE Attack

SSL Server Test

All shipping products were reviewed and the following notes are applicable:

1. The Smart Graphics installation package contains an affected version of the Adobe Flash Player for Internet Explorer. This will be updated in the next release. In the meanwhile, users may update their own systems via the normal means. This only affects developer’s own systems and no Crestron products.
2. The following products support an embedded browser control which supports Flash: DGE-1, DGE-2, TPMC-8X, TPMC-8X-GA, TPMC-V12, TPMC-V15. However, the version of Flash installed on these products is not a version affected. In addition, if the user project on the system does not support browsing to arbitrary sites, the systems are not affected. Note that this does not affect Smart Graphics projects.

CVE-2015-7547: glibc getaddrinfo stack-based buffer overflow

CVE-2015-7547 Detail

CVE-2015-0235 is a vulnerability that really doesn’t apply to Crestron’s products, as it requires a custom written program to run on the device to exploit this vulnerabilities; none of our devices really have this capability.

However, we have looked through our products, and where applicable, have patched the libraries affected:

The PRO3/AV3/CP3N’s router firmware has been patched, and will be available by next month.

The ATC-AUDIONET is the only other product with libraries that have this vulnerability; at the moment, a firmware upgrade is not scheduled to resolve this, mostly due to the fact that the unit is unable to run custom code.

There is a severe vulnerability in OpenSSL's implementation of the TLS/DTLS (transport layer security protocols) heartbeat extension (RFC6520). This is a serious vulnerability which has been assigned the CVE identifier CVE-2014-0160.

Exploitation may lead to disclosure of memory contents from the server to the client and from the client to the server. An attacker can remotely retrieve sensitive data from memory, including, but not limited to secret keys used for SSL encryption and authentication tokens.

Crestron has carefully examined the versions of OpenSSL used in its product line. With the exception of the following three, none of Crestron's devices, software, web sites or tools have been determined to have this vulnerability.

Crestron has incorporated a fix into firmware v1.1.1 which was released on March 10, 2015.

1. Crestron App for iOS (Current Released Version)
   • Crestron has incorporated a fix into v1.02.42 which was released on May 28, 2014.
   • It should be noted that this application will only use SSL in connection to a Crestron Control System. To take advantage of this vulnerability in versions prior to v1.02.42, an attacker would need to coerce an end user to change application connection settings to connect to another non-control system device which was specifically coded to retrieve this data.
2. Crestron Mobile and Crestron Mobile Pro for Android (running on Android 4.1.1 ONLY)
   • Crestron uses the built-in Android services. Customers with devices running Android 4.1.1 are urged to check with their carrier or device manufacturer for updates.
   • It should be noted that this application will only use SSL in connection to a Crestron Control System. To take advantage of this vulnerability in versions prior to v1.02.42, an attacker would need to coerce an end user to change application connection settings to connect to another non-control system device which was specifically coded to retrieve this data.
3. Crestron AM-100 AirMedia™ Presentation Gateway

Schannel in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allows remote attackers to execute arbitrary code via crafted packets, aka "Microsoft Schannel Remote Code Execution Vulnerability."

As per CVE-2014-6332, OleAut32.dll in OLE in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allows remote attackers to execute arbitrary code via a crafted web site, as demonstrated by an array-redimensioning attempt that triggers improper handling of a size value in the SafeArrayDimen function, aka "Windows OLE Automation Array Remote Code Execution Vulnerability" or WinShock.

All shipping products were reviewed and the following notes are applicable:

1. While Crestron 3-Series processors do use Windows Embedded operating systems, the kernel itself is different and it is not immediately clear if the same deficiency is present. We are working with Microsoft to make this determination. The Web Server in these processors does use SChannel for authentication if SSL is enabled. However, in most installations SSL is not enabled. This is further mitigated by the point that there is no scripting support provided on the 3-series web server and so exploitation would be more difficult.
2. Crestron is working with Microsoft regarding and update to Crestron RL. However, as this is an embedded system with code protection enabled it is not clear the vulnerability is exploitable.
3. Crestron is working with Microsoft regarding an update to the TPMC-V12, TPMC-V15, DGE-1. However, as this is an embedded system with code protection enabled, it is not clear the vulnerability is exploitable.
4. Customers running Fusion are urged to make sure to apply Windows updates.

AIRMEDIA AM-100 and AM-101 Vulnerabilities

We are making the AM-100/101 firmware available today publicly. Anyone requiring assistance should reach out to True Blue Support.

The latest AM-100/101 firmware release include fixes for the following vulnerabilities: CVE-2019-3929, CVE-2019-3930, CVE-2019-3925 CVE-2019-3926, CVE-2019-3931, CVE-2019-3932, CVE-2019-3939, CVE-2019-3927, CVE-2019-3928, CVE-2019-3933, CVE-2019-3934, CVE-2019-3935, CVE-2019-3936, CVE-2019-3937, and CVE-2019-3938. See link below under Resources.

Please note the following vulnerabilities only affect the Airmedia AM-100 and AM-101 devices. All other second generation AirMedia devices are not affected.

CVE-2019-3925: Unauthenticated Remote OS Command Injection via SNMP #1
Crestron is aware of a vulnerability that the AM-100 with firmware 1.6.0.2 and AM-101 with firmware 2.7.0.2 are vulnerable to command injection via SNMP OID iso.3.6.1.4.1.3212.100.3.2.9.3. A remote, unauthenticated attacker can use this vulnerability to execute operating system commands as root. This vulnerability has been resolved with the firmware release AM-100/101 v.1.7.1.7_2.8.0.27.

CVE-2019-3926: Unauthenticated Remote Command Injection via SNMP #2
Crestron is aware of a vulnerability that the AM-100 with firmware 1.6.0.2 and AM-101 with firmware 2.7.0.2 are vulnerable to command injection via SNMP OID iso.3.6.1.4.1.3212.100.3.2.14.1. A remote, unauthenticated attacker can use this vulnerability to execute operating system commands as root. This vulnerability has been resolved with the firmware release AM-100/101 v.1.7.1.7_2.8.0.27.

CVE-2019-3927: Unauthenticated Remote Admin Password Change via SNMP
Crestron is aware of a vulnerability that the AM-100 with firmware 1.6.0.2 and AM-101 with firmware 2.7.0.2 anyone can change the administrator and moderator passwords via the iso.3.6.1.4.1.3212.100.3.2.8.1 and iso.3.6.1.4.1.3212.100.3.2.8.2 OIDs. A remote, unauthenticated attacker can use this vulnerability to change the admin or moderator user's password and gain access to restricted areas on the HTTP interface. This vulnerability has been resolved with the firmware release AM-100/101 v.1.7.1.7_2.8.0.27.

CVE-2019-3928: Unauthenticated Remote Information Leak via SNMP
Crestron is aware of a vulnerability that the AM-100 with firmware 1.6.0.2 and AM-101 with firmware 2.7.0.2 allow any user to obtain the presentation passcode via the iso.3.6.1.4.1.3212.100.3.2.7.4 OIDs. A remote, unauthenticated attacker can use this vulnerability to access a restricted presentation or to become the presenter. This vulnerability has been resolved with the firmware release AM-100/101 v.1.7.1.7_2.8.0.27. A warning will now appear if SNMP v1 or v2 is used. Crestron recommends using SNMP v3 to avoid this issue.

CVE-2019-3929: Unauthenticated Remote OS Command Injection via file_transfer.cgi
Crestron is aware of a vulnerability that AM-100 with firmware 1.6.0.2 and Crestron AM-101 with firmware 2.7.0.1, are vulnerable to command injection via the file_transfer.cgi HTTP endpoint. A remote, unauthenticated attacker can use this vulnerability to execute operating system commands as root. This vulnerability has been resolved with the firmware release AM-100/101 v.1.7.1.7_2.8.0.27.

CVE-2019-3930: Unauthenticated Remote Stack Buffer Overflow via file_transfer.cgi
Crestron is aware of a vulnerability that AM-100 with firmware 1.6.0.2 and Crestron AM-101 with firmware 2.7.0.1, are vulnerable to a stack buffer overflow in libAwgCgi.so's PARSERtoCHAR function. A remote, unauthenticated attacker can use this vulnerability to execute arbitrary code as root via a crafted request to the return.cgi endpoint. This vulnerability has been resolved with the firmware release AM-100/101 v.1.7.1.7_2.8.0.27.

CVE-2019-3931: Remote View Pass Code Bypass and Information Leak
Crestron is aware of a vulnerability that the AM-100 with firmware 1.6.0.2 and AM-101 with firmware 2.7.0.2 are vulnerable to argumentation injection to the curl binary via crafted HTTP requests to return.cgi. A remote, authenticated attacker can use this vulnerability to upload files to the device and ultimately execute code as root. This vulnerability has been resolved with the firmware release AM-100/101 v.1.7.1.7_2.8.0.27.

CVE-2019-3932: Authentication Bypass in return.tgi
Crestron is aware of a vulnerability that the AM-100 with firmware 1.6.0.2 and AM-101 with firmware 2.7.0.2 are vulnerable to authentication bypass due to a hard-coded password in return.tgi. A remote, unauthenticated attacker can use this vulnerability to control external devices via the uart_bridge. This vulnerability has been resolved with the firmware release AM-100/101 v.1.7.1.7_2.8.0.27.

CVE-2019-3933: Authentication bypass to view "remote view" via HTTP browserslide.jpg
Crestron is aware of a vulnerability that the AM-100 with firmware 1.6.0.2 and AM-101 with firmware 2.7.0.2 allows anyone to bypass the presentation code simply by requesting /images/browserslide.jpg via HTTP. A remote, unauthenticated attacker can use this vulnerability to watch a slideshow without knowing the access code. This vulnerability has been resolved with the firmware release AM-100/101 v.1.7.1.7_2.8.0.27.

CVE-2019-3934: Remove View Pass Code Bypass #2
Crestron is aware of a vulnerability that the AM-100 with firmware 1.6.0.2 and AM-101 with firmware 2.7.0.2 allows anyone to bypass the presentation code sending a crafted HTTP POST request to login.cgi. A remote, unauthenticated attacker can use this vulnerability to download the current slide image without knowing the access code. This vulnerability has been resolved with the firmware release AM-100/101 v.1.7.1.7_2.8.0.27.

CVE-2019-3935: Unauthenticated Remote Moderator Controls via HTTP
Crestron is aware of a vulnerability that the AM-100 with firmware 1.6.0.2 and AM-101 with firmware 2.7.0.2 allows anyone to act as a moderator to a slide show via crafted HTTP POST requests to conference.cgi. A remote, unauthenticated attacker can use this vulnerability to start, stop, and disconnect active slideshows. This vulnerability has been resolved with the firmware release AM-100/101 v.1.7.1.7_2.8.0.27.

CVE-2019-3936: Unauthenticated Remote View Control via port 389
Crestron is aware of a vulnerability that the AM-100 with firmware 1.6.0.2 and AM-101 with firmware 2.7.0.2 is vulnerable to denial of service via a crafted request to TCP port 389. The request will force the slideshow to transition into a "stopped" state. A remote, unauthenticated attacker can use this vulnerability to stop an active slideshow. This vulnerability has been resolved with the firmware release AM-100/101 v.1.7.1.7_2.8.0.27.

CVE-2019-3937: Credentials Stored in Plaintext
Crestron is aware of a vulnerability that the AM-100 with firmware 1.6.0.2 and AM-101 with firmware 2.7.0.2 stores usernames, passwords, slideshow passcode, and other configuration options in cleartext in the file /tmp/scfgdndf. A local attacker can use this vulnerability to recover sensitive data. This vulnerability has been resolved with the firmware release AM-100/101 v.1.7.1.7_2.8.0.27.

CVE-2019-3938: Exported Configuration Files Contain Credentials
Crestron is aware of a vulnerability that the AM-100 with firmware 1.6.0.2 and AM-101 with firmware 2.7.0.2 stores usernames, passwords, and other configuration options in the file generated via the "export configuration" feature. The configuration file is encrypted using the awenc binary. The same binary can be used to decrypt any configuration file since all the encryption logic is hard coded. A local attacker can use this vulnerability to gain access to devices username and passwords. This vulnerability has been resolved with the firmware release AM-100/101 v.1.7.1.7_2.8.0.27.

• CVE-2020-11896
• CVE-2020-11897
• CVE-2020-11898
• CVE-2020-11899
• CVE-2020-11900
• CVE-2020-11901
• CVE-2020-11902
• CVE-2020-11903
• CVE-2020-11904
• CVE-2020-11905
• CVE-2020-11906
• CVE-2020-11907
• CVE-2020-11908
• CVE-2020-11909
• CVE-2020-11910
• CVE-2020-11911
• CVE-2020-11912
• CVE-2020-11913
• CVE-2020-11914

• CVE-2020-24588: aggregation attack (accepting non-SPP A-MSDU frames).
• CVE-2020-24587: mixed key attack (reassembling fragments encrypted under different keys).
• CVE-2020-24586: fragment cache attack (not clearing fragments from memory when (re)connecting to a network).

• CVE-2020-26145: Accepting plain text broadcast fragments as full frames (in an encrypted network).
• CVE-2020-26144: Accepting plain text A-MSDU frames that start with an RFC1042 header with EtherType EAPOL (in an encrypted network).
• CVE-2020-26140: Accepting plain text data frames in a protected network.
• CVE-2020-26143: Accepting fragmented plain text data frames in a protected network.

• CVE-2020-26139: Forwarding EAPOL frames even though the sender is not yet authenticated (should only affect APs).
• CVE-2020-26146: Reassembling encrypted fragments with non-consecutive packet numbers.
• CVE-2020-26147: Reassembling mixed encrypted/plain text fragments.
• CVE-2020-26142: Processing fragmented frames as full frames.
• CVE-2020-26141: Not verifying the TKIP MIC of fragmented frames.

• CVE-2021-31344 - ICMP echo packets with fake IP options allow sending ICMP echo reply messages to arbitrary hosts on the network.
•  CVE-2021-31345 - The total length of an UDP payload (set in the IP header) is unchecked. This may lead to various side effects, including Information Leak and Denial-of-Service conditions, depending on a user-defined applications that runs on top of the UDP protocol.
• CVE-2021-31346 - The total length of an ICMP payload (set in the IP header) is unchecked. This may lead to various side effects, including Information Leak and Denial-of-Service conditions, depending on the network buffer organization in memory.
• CVE-2021-31881- When processing a DHCP OFFER message, the DHCP client application does not validate the length of the Vendor option(s), leading to Denial-of-Service conditions.
• CVE-2021-31882 - The DHCP client application does not validate the length of the Domain Name Server IP option(s) (0x06) when processing DHCP ACK packets. This may lead to Denial-of-Service conditions.
• CVE-2021-31883 - When processing a DHCP ACK message, the DHCP client application does not validate the length of the Vendor option(s), leading to Denial-of-Service conditions.
• CVE-2021-31884 - The DHCP client application assumes that the data supplied with the “Hostname” DHCP option is NULL terminated. In cases when global hostname variable is not defined, this may lead to Out-of-bound reads, writes, and Denial-of-service conditions.
• CVE-2021-31885 - TFTP server application allows for reading the contents of the TFTP memory buffer via sending malformed TFTP commands.
• CVE-2021-31886 - FTP server does not properly validate the length of the “USER” command, leading to stack-based buffer overflows. This may result in Denial-of-Service conditions and Remote Code Execution.
• CVE-2021-31887 - FTP server does not properly validate the length of the “PWD/XPWD” command, leading to stack-based buffer overflows. This may result in Denial-of-Service conditions and Remote Code Execution.
• CVE-2021-31888 - FTP server does not properly validate the length of the “MKD/XMKD” command, leading to stack-based buffer overflows. This may result in Denial-of-Service conditions and Remote Code Execution.
• CVE-2021-31889 - Malformed TCP packets with a corrupted SACK option leads to Information Leaks and Denial-of-Service conditions.
• CVE-2021-31890 - The total length of an TCP payload (set in the IP header) is unchecked. This may lead to various side effects, including Information Leak and Denial-of-Service conditions, depending on the network buffer organization in memory.

• 2-Series Control Processors – most of these products are discontinued with the notable exceptions of the GLPAC and GL-IPAC
• DM-MD6X4 and DM-MD6X6
• DMC-CPU-8/16
• DMPS3-300-C and DMPS3-300-C-AEC - (Used on Internal Components only - no direct network access)
• SWAMP and related products
• CEN-TRACK

direct link to

• pdf: https://cert-portal.siemens.com/productcert/pdf/ssa-044112.pdf
• txt: https://cert-portal.siemens.com/productcert/txt/ssa-044112.txt
• csaf: https://cert-portal.siemens.com/productcert/csaf/ssa-044112.json

Crestron has completed a review of all its products and services and have found none which use Log4j and therefore none are affected by this vulnerability.

• HD-MD4x1-4K-E
• HD-MD4x2-4K-E
• HD-MD6x2-4K-E

• HD-MD4x1-4KZ-E
• HD-MD4x2-4KZ-E
• HD-MD6x2-4KZ-E

This vulnerability affects all 3-Series Control systems running versions prior to 1.8001.0187. These systems include, but are not limited to:
CP3N
CP3
RMC3
PRO3

Please note: The 3-Series Control System is only affected if BACnet is in use.

For more information, please see CVE-2023-38405