Sign-up

ID

VAR-201904-0317


CVE

CVE-2019-3926


TITLE

Crestron AM-100 and AM-101 Command injection vulnerability in some firmware

Trust: 0.8

sources: JVNDB: JVNDB-2019-004070

DESCRIPTION

Crestron AM-100 with firmware 1.6.0.2 and AM-101 with firmware 2.7.0.2 are vulnerable to command injection via SNMP OID iso.3.6.1.4.1.3212.100.3.2.14.1. A remote, unauthenticated attacker can use this vulnerability to execute operating system commands as root. Crestron AM-100 and AM-101 Has a command injection vulnerability.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state. Crestron Electronics AM-100 and Crestron Electronics AM-101 are all american Crestron Electronics A smart home gateway product of the company. This vulnerability stems from the fact that the network system or product does not correctly filter special elements in the process of constructing executable commands from external input data

Trust: 1.8

sources: NVD: CVE-2019-3926 // JVNDB: JVNDB-2019-004070 // VULHUB: VHN-155361 // VULMON: CVE-2019-3926

AFFECTED PRODUCTS

vendor:crestronmodel:am-100scope:eqversion:1.6.0.2

Trust: 1.0

vendor:crestronmodel:am-101scope:eqversion:2.7.0.2

Trust: 1.0

vendor:crestronmodel:airmedia am-100scope:eqversion:1.6.0.2

Trust: 0.8

vendor:crestronmodel:airmedia am-101scope:eqversion:2.7.0.2

Trust: 0.8

sources: JVNDB: JVNDB-2019-004070 // NVD: CVE-2019-3926

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2019-3926
value: CRITICAL

Trust: 1.0

NVD: CVE-2019-3926
value: CRITICAL

Trust: 0.8

CNNVD: CNNVD-201904-1384
value: CRITICAL

Trust: 0.6

VULHUB: VHN-155361
value: HIGH

Trust: 0.1

VULMON: CVE-2019-3926
value: HIGH

Trust: 0.1

nvd@nist.gov: CVE-2019-3926
severity: HIGH
baseScore: 10.0
vectorString: AV:N/AC:L/AU:N/C:C/I:C/A:C
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: COMPLETE
integrityImpact: COMPLETE
availabilityImpact: COMPLETE
exploitabilityScore: 10.0
impactScore: 10.0
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.9

VULHUB: VHN-155361
severity: HIGH
baseScore: 10.0
vectorString: AV:N/AC:L/AU:N/C:C/I:C/A:C
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: COMPLETE
integrityImpact: COMPLETE
availabilityImpact: COMPLETE
exploitabilityScore: 10.0
impactScore: 10.0
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.1

nvd@nist.gov: CVE-2019-3926
baseSeverity: CRITICAL
baseScore: 9.8
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: 3.9
impactScore: 5.9
version: 3.1

Trust: 1.0

NVD: CVE-2019-3926
baseSeverity: CRITICAL
baseScore: 9.8
vectorString: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: NONE
impactScore: NONE
version: 3.0

Trust: 0.8

sources: VULHUB: VHN-155361 // VULMON: CVE-2019-3926 // JVNDB: JVNDB-2019-004070 // CNNVD: CNNVD-201904-1384 // NVD: CVE-2019-3926

PROBLEMTYPE DATA

problemtype:CWE-78

Trust: 1.1

problemtype:CWE-79

Trust: 1.0

problemtype:CWE-77

Trust: 0.9

sources: VULHUB: VHN-155361 // JVNDB: JVNDB-2019-004070 // NVD: CVE-2019-3926

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-201904-1384

TYPE

operating system commend injection

Trust: 0.6

sources: CNNVD: CNNVD-201904-1384

CONFIGURATIONS

sources:
            
            
            JVNDB: JVNDB-2019-004070

PATCH
title:AM-100url:https://www.crestron.com/en-US/Products/Workspace-Solutions/Wireless-Presentation-Solutions/AirMedia-Presentation-Gateways/AM-100
Trust: 0.8
title:AM-101url:https://www.crestron.com/en-US/Products/Workspace-Solutions/Wireless-Presentation-Solutions/AirMedia-Presentation-Gateways/AM-101
Trust: 0.8
title:Threatposturl:https://threatpost.com/bugs-wireless-presentation-systems/144318/
Trust: 0.1
sources:
            
            
            VULMON: CVE-2019-3926 // 
            
            
            
            JVNDB: JVNDB-2019-004070

EXTERNAL IDS
db:NVDid:CVE-2019-3926
Trust: 2.6
db:TENABLEid:TRA-2019-20
Trust: 2.6
db:JVNDBid:JVNDB-2019-004070
Trust: 0.8
db:CNNVDid:CNNVD-201904-1384
Trust: 0.7
db:VULHUBid:VHN-155361
Trust: 0.1
db:VULMONid:CVE-2019-3926
Trust: 0.1
sources:
            
            
            VULHUB: VHN-155361 // 
            
            
            
            VULMON: CVE-2019-3926 // 
            
            
            
            JVNDB: JVNDB-2019-004070 // 
            
            
            
            CNNVD: CNNVD-201904-1384 // 
            
            
            
            NVD: CVE-2019-3926

REFERENCES
url:https://www.tenable.com/security/research/tra-2019-20
Trust: 2.6
url:https://nvd.nist.gov/vuln/detail/cve-2019-3926
Trust: 1.4
url:https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2019-3926
Trust: 0.8
url:https://cwe.mitre.org/data/definitions/78.html
Trust: 0.1
url:https://nvd.nist.gov
Trust: 0.1
url:https://threatpost.com/bugs-wireless-presentation-systems/144318/
Trust: 0.1
sources:
            
            
            VULHUB: VHN-155361 // 
            
            
            
            VULMON: CVE-2019-3926 // 
            
            
            
            JVNDB: JVNDB-2019-004070 // 
            
            
            
            CNNVD: CNNVD-201904-1384 // 
            
            
            
            NVD: CVE-2019-3926

SOURCES
db:VULHUBid:VHN-155361
db:VULMONid:CVE-2019-3926
db:JVNDBid:JVNDB-2019-004070
db:CNNVDid:CNNVD-201904-1384
db:NVDid:CVE-2019-3926

LAST UPDATE DATE
2024-11-23T21:37:29.102000+00:00

SOURCES UPDATE DATE
db:VULHUBid:VHN-155361date:2020-10-16T00:00:00
db:VULMONid:CVE-2019-3926date:2020-10-16T00:00:00
db:JVNDBid:JVNDB-2019-004070date:2019-05-27T00:00:00
db:CNNVDid:CNNVD-201904-1384date:2020-10-28T00:00:00
db:NVDid:CVE-2019-3926date:2024-11-21T04:42:52.700

SOURCES RELEASE DATE
db:VULHUBid:VHN-155361date:2019-04-30T00:00:00
db:VULMONid:CVE-2019-3926date:2019-04-30T00:00:00
db:JVNDBid:JVNDB-2019-004070date:2019-05-27T00:00:00
db:CNNVDid:CNNVD-201904-1384date:2019-04-30T00:00:00
db:NVDid:CVE-2019-3926date:2019-04-30T21:29:00.543