CR
Vendor
Crestron
71
CVEs
4
On KEV
0
New 30D
Products
AF9.8
Am-100 Firmware
Crestron
15 CVEs1 on KEV0 new
AF9.8
Am-101 Firmware
Crestron
15 CVEs1 on KEV0 new
CA9.8
Crestron AirMedia, Barco WePresent, Extron ShareLink, Teq AV IT WIPS710, SHARP PN-L703WA, Optoma WPS-Pro, Blackbox HD WPS, InFocus LiteShow3, and InFocus LiteShow4.
Crestron
1 CVEs1 on KEV0 new
MP9.8
Multiple Products
Crestron
1 CVEs1 on KEV0 new
DF9.8
Dm-txrx-100-str Firmware
Crestron
6 CVEs0 on KEV0 new
AA9.8
Airmedia Am-100 Firmware
Crestron
5 CVEs0 on KEV0 new
AI8.8
Airmedia
Crestron
4 CVEs0 on KEV0 new
AA7.2
Airmedia Am-101 Firmware
Crestron
2 CVEs0 on KEV0 new
CT9.8
Crestron Toolbox Protocol Firmware
Crestron
2 CVEs0 on KEV0 new
MF9.8
Mc3 Firmware
Crestron
2 CVEs0 on KEV0 new
TF9.8
Tsw-x60 Firmware
Crestron
2 CVEs0 on KEV0 new
AF7.8
Am-300 Firmware
Crestron
1 CVEs0 on KEV0 new
C67.5
Cp3 6504877 Firmware
Crestron
1 CVEs0 on KEV0 new
C67.5
Cp3-gv 6506034 Firmware
Crestron
1 CVEs0 on KEV0 new
C67.5
Cp3n 6505417 Firmware
Crestron
1 CVEs0 on KEV0 new
DF9.8
Dge-100 Firmware
Crestron
1 CVEs0 on KEV0 new
DF9.8
Dm-dge-200-c Firmware
Crestron
1 CVEs0 on KEV0 new
DF7.5
Dm-nvx-dir-160 Firmware
Crestron
1 CVEs0 on KEV0 new
DF7.5
Dm-nvx-dir-80 Firmware
Crestron
1 CVEs0 on KEV0 new
DF7.5
Dm-nvx-dir-ent Firmware
Crestron
1 CVEs0 on KEV0 new
DF9.8
Dmc-stro Firmware
Crestron
1 CVEs0 on KEV0 new
HF9.8
Hd-md4x2-4k-e Firmware
Crestron
1 CVEs0 on KEV0 new
TX5.9
Touchscreen x60s
CRESTRON
1 CVEs0 on KEV0 new
TX5.9
TOUCHSCREEN x70
CRESTRON
1 CVEs0 on KEV0 new
TX6.8
TOUCHSCREENS x60, x70 series
CRESTRON
1 CVEs0 on KEV0 new
TX8.6
TOUCHSCREENS x70
CRESTRON
1 CVEs0 on KEV0 new
TF9.8
Ts-1542-c Firmware
Crestron
1 CVEs0 on KEV0 new
Recent CVEs
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2025-47415 | TX TOUCHSCREENS x60, x70 series CRESTRON | 6.8 | Sep 9 | RECWAVE Filepath Traversal |
| CVE-2025-47416 | TX TOUCHSCREEN x70 CRESTRON | 5.9 | Sep 9 | ConsoleFindCommandMatchList |
| CVE-2025-47421 | TX TOUCHSCREENS x70 CRESTRON | 8.6 | Sep 3 | Privilege escalation via SCP login |
| CVE-2023-6926 | AF Am-300 Firmware Crestron | 7.8 | Jan 23 | There is an OS command injection vulnerability in Crestron AM-300 firmware version 1.4499.00018 which may enable a user of a limited-access SSH session to escalate their… |
| CVE-2023-38405 | C6 Cp3-gv 6506034 Firmware Crestron | 7.5 | Jul 17 | On Crestron 3-Series Control Systems before 1.8001.0187, crafting and sending a specific BACnet packet can cause a crash |
| CVE-2022-40298 | AI Airmedia Crestron | 8.8 | Sep 23 | Crestron AirMedia for Windows before 5.5.1.84 has insecure inherited permissions, which leads to a privilege escalation vulnerability found in the AirMedia Windows Application,… |
| CVE-2022-34102 | AI Airmedia Crestron | 8.8 | Sep 13 | Insufficient access control vulnerability was discovered in the Crestron AirMedia Windows Application, version 4.3.1.39, in which a user can pause the uninstallation of an… |
| CVE-2022-34101 | AI Airmedia Crestron | 7.8 | Sep 13 | A vulnerability was discovered in the Crestron AirMedia Windows Application, version 4.3.1.39, in which a user can place a malicious DLL in a certain path to execute code and… |
| CVE-2022-34100 | AI Airmedia Crestron | 8.8 | Sep 13 | A vulnerability was discovered in the Crestron AirMedia Windows Application, version 4.3.1.39, in which a low-privileged user can gain a SYSTEM level command prompt by pre-staging… |
| CVE-2022-23178 | HF Hd-md4x2-4k-e Firmware Crestron | 9.8 | Jan 15 | An issue was discovered on Crestron HD-MD4X2-4K-E 1.0.0.2159 devices |
| CVE-2020-16839 | DF Dm-nvx-dir-80 Firmware Crestron | 7.5 | Jul 30 | On Crestron DM-NVX-DIR, DM-NVX-DIR80, and DM-NVX-ENT devices before the DM-XIO/1-0-3-802 patch, the password can be changed by sending an unauthenticated WebSocket request |
| CVE-2019-18184 | DF Dmc-stro Firmware Crestron | 9.8 | Nov 27 | Crestron DMC-STRO 1.0 devices allow remote command execution as root via shell metacharacters to the ping function |
| CVE-2019-3939 | AF Am-100 Firmware Crestron | 9.8 | Apr 30 | Crestron AM-100 with firmware 1.6.0.2 and AM-101 with firmware 2.7.0.2 use default credentials admin/admin and moderator/moderator for the web interface |
| CVE-2019-3938 | AF Am-100 Firmware Crestron | 7.8 | Apr 30 | Crestron AM-100 with firmware 1.6.0.2 and AM-101 with firmware 2.7.0.2 stores usernames, passwords, and other configuration options in the file generated via the "export… |
| CVE-2019-3937 | AF Am-100 Firmware Crestron | 7.8 | Apr 30 | Crestron AM-100 with firmware 1.6.0.2 and AM-101 with firmware 2.7.0.2 stores usernames, passwords, slideshow passcode, and other configuration options in cleartext in the file… |
| CVE-2019-3936 | AF Am-101 Firmware Crestron | 7.5 | Apr 30 | Crestron AM-100 with firmware 1.6.0.2 and AM-101 with firmware 2.7.0.2 is vulnerable to denial of service via a crafted request to TCP port 389 |
| CVE-2019-3935 | AF Am-101 Firmware Crestron | 9.1 | Apr 30 | Crestron AM-100 with firmware 1.6.0.2 and AM-101 with firmware 2.7.0.2 allows anyone to act as a moderator to a slide show via crafted HTTP POST requests to conference.cgi |
| CVE-2019-3934 | AF Am-101 Firmware Crestron | 5.3 | Apr 30 | Crestron AM-100 with firmware 1.6.0.2 and AM-101 with firmware 2.7.0.2 allows anyone to bypass the presentation code sending a crafted HTTP POST request to login.cgi |
| CVE-2019-3933 | AF Am-100 Firmware Crestron | 5.3 | Apr 30 | Crestron AM-100 with firmware 1.6.0.2 and AM-101 with firmware 2.7.0.2 allows anyone to bypass the presentation code simply by requesting /images/browserslide.jpg via HTTP |
| CVE-2019-3932 | AF Am-100 Firmware Crestron | 9.8 | Apr 30 | Crestron AM-100 with firmware 1.6.0.2 and AM-101 with firmware 2.7.0.2 are vulnerable to authentication bypass due to a hard-coded password in return.tgi |
| CVE-2019-3931 | AF Am-100 Firmware Crestron | 8.8 | Apr 30 | Crestron AM-100 with firmware 1.6.0.2 and AM-101 with firmware 2.7.0.2 are vulnerable to argumention injection to the curl binary via crafted HTTP requests to return.cgi |
| CVE-2019-3930 | AF Am-100 Firmware Crestron | 9.8 | Apr 30 | The Crestron AM-100 firmware 1.6.0.2, Crestron AM-101 firmware 2.7.0.1, Barco wePresent WiPG-1000P firmware 2.3.0.10, Barco wePresent WiPG-1600W before firmware 2.4.1.19, Extron… |
| CVE-2019-3928 | AF Am-101 Firmware Crestron | 5.3 | Apr 30 | Crestron AM-100 with firmware 1.6.0.2 and AM-101 with firmware 2.7.0.2 allow any user to obtain the presentation passcode via the iso.3.6.1.4.1.3212.100.3.2.7.4 OIDs |
| CVE-2019-3927 | AF Am-101 Firmware Crestron | 9.8 | Apr 30 | Crestron AM-100 with firmware 1.6.0.2 and AM-101 with firmware 2.7.0.2 anyone can change the administrator and moderator passwords via the iso.3.6.1.4.1.3212.100.3.2.8.1 and… |
| CVE-2019-3926 | AF Am-100 Firmware Crestron | 9.8 | Apr 30 | Crestron AM-100 with firmware 1.6.0.2 and AM-101 with firmware 2.7.0.2 are vulnerable to command injection via SNMP OID iso.3.6.1.4.1.3212.100.3.2.14.1 |
| CVE-2019-3925 | AF Am-100 Firmware Crestron | 9.8 | Apr 30 | Crestron AM-100 with firmware 1.6.0.2 and AM-101 with firmware 2.7.0.2 are vulnerable to command injection via SNMP OID iso.3.6.1.4.1.3212.100.3.2.9.3 |
| CVE-2019-3929 In wildKEV | CA Crestron AirMedia, Barco WePresent, Extron ShareLink, Teq AV IT WIPS710, SHARP PN-L703WA, Optoma WPS-Pro, Blackbox HD WPS, InFocus LiteShow3, and InFocus LiteShow4. Crestron | 9.8 | Apr 30 | Crestron Multiple Products Command Injection Vulnerability |
| CVE-2019-3910 | AA Airmedia Am-100 Firmware Crestron | 9.1 | Jan 18 | Crestron AM-100 before firmware version 1.6.0.2 contains an authentication bypass in the web interface's return.cgi script |
| CVE-2018-13341 | MF Mc3 Firmware Crestron | 8.8 | Aug 10 | Crestron TSW-X60 all versions prior to 2.001.0037.001 and MC3 all versions prior to 1.502.0047.00, The passwords for special sudo accounts may be calculated using information… |
| CVE-2018-10630 | TF Tsw-x60 Firmware Crestron | 9.8 | Aug 10 | For Crestron TSW-X60 version prior to 2.001.0037.001 and MC3 version prior to 1.502.0047.001, The devices are shipped with authentication disabled, and there is no indication to… |
| CVE-2017-16710 | AA Airmedia Am-101 Firmware Crestron | 4.8 | Jul 11 | Cross-site scripting (XSS) vulnerability in Crestron Airmedia AM-100 devices with firmware before 1.6.0 and AM-101 devices with firmware before 2.7.0 allows remote attackers to… |
| CVE-2017-16709 | AA Airmedia Am-101 Firmware Crestron | 7.2 | Jul 11 | Crestron Airmedia AM-100 devices with firmware before 1.6.0 and AM-101 devices with firmware before 2.7.0 allows remote authenticated administrators to execute arbitrary code via… |
| CVE-2018-5553 | DF Dge-100 Firmware Crestron | 9.8 | Jul 10 | The Crestron Console service running on DGE-100, DM-DGE-200-C, and TS-1542-C devices with default configuration and running firmware versions 1.3384.00049.001 and lower are… |
| CVE-2018-11229 | CT Crestron Toolbox Protocol Firmware Crestron | 9.8 | Jun 8 | Crestron TSW-1060, TSW-760, TSW-560, TSW-1060-NC, TSW-760-NC, and TSW-560-NC devices before 2.001.0037.001 allow unauthenticated remote code execution via command injection in… |
| CVE-2018-11228 | CT Crestron Toolbox Protocol Firmware Crestron | 9.8 | Jun 8 | Crestron TSW-1060, TSW-760, TSW-560, TSW-1060-NC, TSW-760-NC, and TSW-560-NC devices before 2.001.0037.001 allow unauthenticated remote code execution via a Bash shell service in… |
| CVE-2016-5671 | DF Dm-txrx-100-str Firmware Crestron | 8.8 | Aug 3 | Multiple cross-site request forgery (CSRF) vulnerabilities on Crestron Electronics DM-TXRX-100-STR devices with firmware through 1.3039.00040 allow remote attackers to hijack the… |
| CVE-2016-5670 | DF Dm-txrx-100-str Firmware Crestron | 9.8 | Aug 3 | Crestron Electronics DM-TXRX-100-STR devices with firmware before 1.3039.00040 have a hardcoded password of admin for the admin account, which makes it easier for remote attackers… |
| CVE-2016-5669 | DF Dm-txrx-100-str Firmware Crestron | 9.8 | Aug 3 | Crestron Electronics DM-TXRX-100-STR devices with firmware before 1.3039.00040 use a hardcoded 0xb9eed4d955a59eb3 X.509 certificate from an OpenSSL Test Certification Authority,… |
| CVE-2016-5668 | DF Dm-txrx-100-str Firmware Crestron | 9.8 | Aug 3 | Crestron Electronics DM-TXRX-100-STR devices with firmware before 1.3039.00040 allow remote attackers to bypass authentication and change settings via a JSON API call |
| CVE-2016-5667 | DF Dm-txrx-100-str Firmware Crestron | 9.8 | Aug 3 | Crestron Electronics DM-TXRX-100-STR devices with firmware before 1.3039.00040 allow remote attackers to bypass authentication via a direct request to a page other than index.html |
| CVE-2016-5666 | DF Dm-txrx-100-str Firmware Crestron | 9.8 | Aug 3 | Crestron Electronics DM-TXRX-100-STR devices with firmware before 1.3039.00040 rely on the client to perform authentication, which allows remote attackers to obtain access by… |
| CVE-2016-5640 | AA Airmedia Am-100 Firmware Crestron | 9.8 | Aug 3 | Directory traversal vulnerability in cgi-bin/rftest.cgi on Crestron AirMedia AM-100 devices with firmware before 1.4.0.13 allows remote attackers to execute arbitrary commands via… |
| CVE-2016-5639 | AA Airmedia Am-100 Firmware Crestron | 7.5 | Aug 3 | Directory traversal vulnerability in cgi-bin/login.cgi on Crestron AirMedia AM-100 devices with firmware before 1.4.0.13 allows remote attackers to read arbitrary files via a |