CVE-2018-5553 Crestron DGE-100 Console Command Injection (FIXED)
CriticalCVSS 9.8
EPSS 2.5%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The Crestron Console service running on DGE-100, DM-DGE-200-C, and TS-1542-C devices with default configuration and running firmware versions 1.3384.00049.001 and lower are vulnerable to command injection that can be used to gain root-level access.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| crestron dge-100 firmware | <= 1.3384.00049.001 | No fix listed |
| crestron dm-dge-200-c firmware | <= 1.3384.00049.001 | No fix listed |
| crestron ts-1542-c firmware | <= 1.3384.00049.001 | No fix listed |
| crestron DGE-100 | <= 1.3384.00049.001 | No fix listed |
| crestron TS-1542-C | <= 1.3384.00049.001 | No fix listed |
| crestron DM-DGE-200-C | <= 1.3384.00049.001 | No fix listed |
References
- blog.rapid7.com third-party-advisory
- support.crestron.com vendor-advisory