Home

Description

Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') vulnerability in CRESTRON TOUCHSCREENS x70 allows Argument Injection.This issue affects TOUCHSCREENS x70: from 3.001.0031.001 through 3.001.0034.001. A specially crafted SCP command sent via SSH login string can lead a valid administrator user to gain Privileged Operating System access on the device. Following Products Models are affected: TSW-x70 TSW-x60 TST-1080 AM-3000/3100/3200 Soundbar VB70 HD-PS622/621/402 HD-TXU-RXU-4kZ-211 HD-MDNXM-4KZ-E *Note: additional firmware updates will be published once made available

PUBLISHED Reserved 2025-05-06 | Published 2025-09-03 | Updated 2025-09-03 | Assigner Crestron




HIGH: 8.6CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Problem types

CWE-88 Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')

Product status

Default status
unaffected

3.001.0031.001 (custom) before 3.001.0034.001
affected

Credits

Frank Slezak reporter

References

security.crestron.com vendor-advisory

https/...770-TS-1070-TSS-770-TSS-1070-TSW-570/3-002-0040-001 patch

https/...ase_notes/tsw-xx70_3.002.0040.001_release_notes.pdf release-notes

cve.org (CVE-2025-47421)

nvd.nist.gov (CVE-2025-47421)

Download JSON