VulnerabilityAnalyzed

CVE-2019-3929

Crestron Multiple Products Command Injection Vulnerability

KEVEXPLOIT ×2 ✓CRITICAL 9.8EPSS 99.0%

Does this matter?

Known to be exploited in the wild (CISA KEV, CISA remediation deadline 6 May 2022). Treat as an emergency change: patch or isolate now, then hunt for prior compromise.

Description

The Crestron AM-100 firmware 1.6.0.2, Crestron AM-101 firmware 2.7.0.1, Barco wePresent WiPG-1000P firmware 2.3.0.10, Barco wePresent WiPG-1600W before firmware 2.4.1.19, Extron ShareLink 200/250 firmware 2.0.3.4, Teq AV IT WIPS710 firmware 1.1.0.7, SHARP PN-L703WA firmware 1.4.2.3, Optoma WPS-Pro firmware 1.0.0.5, Blackbox HD WPS firmware 1.0.0.5, InFocus LiteShow3 firmware 1.0.16, and InFocus LiteShow4 2.0.0.7 are vulnerable to command injection via the file_transfer.cgi HTTP endpoint. A remote, unauthenticated attacker can use this vulnerability to execute operating system commands as root.

CVSS 3.1: 9.8 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS: 98.95% probability · 100th percentile
Public exploits: 2 in Exploit-DB · verified · first 3 May 2019
CISA KEV: Listed 15 April 2022 · due 6 May 2022
Weakness: CWE-79, CWE-78
Affected: crestron/am-100 firmware · crestron/am-101 firmware · barco/wepresent wipg-1000p firmware · barco/wepresent wipg-1600w firmware · extron/sharelink 200 firmware · extron/sharelink 250 firmware · teqavit/wips710 firmware · sharp/pn-l703wa firmware · optoma/wps-pro firmware · blackbox/hd wireless presentation system firmware · infocus/liteshow3 firmware · infocus/liteshow4 firmware
Source: vulnreport@tenable.com

EPSS trend

EPSS 99.0% since 30 October 2026; no change recorded yet. The dashed line is the ten per cent mark our analysts treat as “patch before the next change window”. Points are recorded when the score first appears and whenever it moves by a percentage point or more.

CISA notes

Apply updates per vendor instructions. https://nvd.nist.gov/vuln/detail/CVE-2019-3929

Public exploits (2)

Entries in Exploit-DB that cite this CVE. Links go to the Exploit-DB page and to the file in the public repository; nothing is hosted here. A verified tick means the Exploit-DB team confirmed the exploit works against the stated version.

EDB-ID	Title	Type	Published	Verified
EDB-47924 source ↗	Barco WePresent - file_transfer.cgi Command Injection (Metasploit)linux · Metasploit	remote	15 January 2020	yes
EDB-46786 source ↗	Crestron AM/Barco wePresent WiPG/Extron ShareLink/Teq AV IT/SHARP PN-L703WA/Optoma WPS-Pro/Blackbox HD WPS/InFocus LiteShow - Remote Command Injectionhardware · Jacob Baines	webapps	3 May 2019	no

References

http://packetstormsecurity.com/files/152715/Barco-AWIND-OEM-Presentation-Platform-Unauthenticated-Remote-Command-Injection.htmlThird Party Advisory, VDB Entry
http://packetstormsecurity.com/files/155948/Barco-WePresent-file_transfer.cgi-Command-Injection.htmlThird Party Advisory, VDB Entry
https://www.exploit-db.com/exploits/46786/Exploit, Third Party Advisory, VDB Entry
https://www.tenable.com/security/research/tra-2019-20Exploit, Third Party Advisory
http://packetstormsecurity.com/files/152715/Barco-AWIND-OEM-Presentation-Platform-Unauthenticated-Remote-Command-Injection.htmlThird Party Advisory, VDB Entry
http://packetstormsecurity.com/files/155948/Barco-WePresent-file_transfer.cgi-Command-Injection.htmlThird Party Advisory, VDB Entry
https://www.exploit-db.com/exploits/46786/Exploit, Third Party Advisory, VDB Entry
https://www.tenable.com/security/research/tra-2019-20Exploit, Third Party Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-3929US Government Resource

Source: NVD record, EPSS from FIRST.org, KEV from CISA, exploits from Exploit-DB. Refreshed daily. Download this record as JSON.