Crestron Patches Command Injection Flaw in DGE-100 Controller

guest · Jun 12, 2018

Crestron Patches Command Injection Flaw in DGE-100 Controller
June 12, 2018
https://www.securityweek.com/crestron-patches-command-injection-flaw-dge-100-controller

Tracked as CVE-2018-5553, the vulnerability has a base CVSSv3 score of 9.8 and is considered Critical severity. Discovered by Rapid7, the security bug is the result of lack of input sanitization and allows an attacker able to connect to the device over TCP port 41795 to gain root-level access.

The DGE-100 controller allows users to connect a touchscreen interface to external sources over HDMI, USB, or Ethernet. The device, which is usually paired with the Crestron TSD-2220 HD touchscreen display, is typically deployed in corporate meeting spaces or control rooms and is distributed globally.

The issue was discovered in March 2018 and reported to the vendor in early April. All DGE-100 devices running firmware version 1.3384.00049.001 and lower with default configuration are vulnerable. Crestron noted in an advisory published last week that TS-1542-C and DM-DGE-200-C devices are also impacted.
Click to expand...

Log in or Sign up

Crestron Patches Command Injection Flaw in DGE-100 Controller

guest Guest

Log in or Sign up

Crestron Patches Command Injection Flaw in DGE-100 Controller

guest Guest

Useful Searches