CVE DATABASE / CVE-2019-3929

CVE-2019-3929

Crestron Multiple Products Command Injection Vulnerability

CVSS 9.8 · CRITICAL ⚠ CISA KEV — ACTIVELY EXPLOITED

On the CISA KEV catalog

Confirmed exploited in the wild. Added 2022-04-15. Federal remediation due 2022-05-06.
Required action: Apply updates per vendor instructions.

Summary

The Crestron AM-100 firmware 1.6.0.2, Crestron AM-101 firmware 2.7.0.1, Barco wePresent WiPG-1000P firmware 2.3.0.10, Barco wePresent WiPG-1600W before firmware 2.4.1.19, Extron ShareLink 200/250 firmware 2.0.3.4, Teq AV IT WIPS710 firmware 1.1.0.7, SHARP PN-L703WA firmware 1.4.2.3, Optoma WPS-Pro firmware 1.0.0.5, Blackbox HD WPS firmware 1.0.0.5, InFocus LiteShow3 firmware 1.0.16, and InFocus LiteShow4 2.0.0.7 are vulnerable to command injection via the file_transfer.cgi HTTP endpoint. A remote, unauthenticated attacker can use this vulnerability to execute operating system commands as root.

CVSS 3.1 breakdown

Base score	9.8 (CRITICAL)
Vector	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector	NETWORK
Attack complexity	LOW
Privileges required	NONE
User interaction	NONE
Scope	UNCHANGED
Confidentiality	HIGH
Integrity	HIGH
Availability	HIGH

Weakness type (CWE)

Affected products

Crestron am-100 firmwareCrestron am-100Crestron am-101 firmwareCrestron am-101Barco wepresent wipg-1000p firmwareBarco wepresent wipg-1000pBarco wepresent wipg-1600w firmwareBarco wepresent wipg-1600wExtron sharelink 200 firmwareExtron sharelink 200Extron sharelink 250 firmwareExtron sharelink 250Teqavit wips710 firmwareTeqavit wips710Sharp pn-l703wa firmwareSharp pn-l703waOptoma wps-pro firmwareOptoma wps-proBlackbox hd wireless presentation system firmwareBlackbox hd wireless presentation system

Check this CVE live

Use our free CVE Lookup tool for the latest NVD record, or browse the full CISA KEV catalog.

References

Data: NIST NVD + CISA KEV. NVD last modified 2025-11-03. Always verify against the vendor advisory before acting.