جزئیات آسیب‌پذیری
CVE-2019-3929
بهره‌برداری فعال
Crestron AirMedia
CVSS 3.1
9.8بحرانی
نمای کلی
اکسپلویت‌های عمومی
اخبار مرتبط
خط زمانی
خلاصه‌ی فارسی
خلاصه‌ی فارسی برای این آسیب‌پذیری هنوز تهیه نشده است.
شرح رسمی (انگلیسی)
The Crestron AM-100 firmware 1.6.0.2, Crestron AM-101 firmware 2.7.0.1, Barco wePresent WiPG-1000P firmware 2.3.0.10, Barco wePresent WiPG-1600W before firmware 2.4.1.19, Extron ShareLink 200/250 firmware 2.0.3.4, Teq AV IT WIPS710 firmware 1.1.0.7, SHARP PN-L703WA firmware 1.4.2.3, Optoma WPS-Pro firmware 1.0.0.5, Blackbox HD WPS firmware 1.0.0.5, InFocus LiteShow3 firmware 1.0.16, and InFocus LiteShow4 2.0.0.7 are vulnerable to command injection via the file_transfer.cgi HTTP endpoint. A remote, unauthenticated attacker can use this vulnerability to execute operating system commands as root.
امتیازهای CVSS
| امتیاز | نسخه | منبع | بردار |
|---|---|---|---|
| 9.8بحرانی | 3.1 | CISA ADP / Vulnrichment (CISA-ADP) | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
محصولات آسیب‌پذیر
| فروشنده | محصول | نسخه‌ها | منبع |
|---|---|---|---|
| Crestron | Crestron AirMedia, Barco WePresent, Extron ShareLink, Teq AV IT WIPS710, SHARP PN-L703WA, Optoma WPS-Pro, Blackbox HD WPS, InFocus LiteShow3, and InFocus LiteShow4. | Barco wePresent WiPG-1000P firmware 2.3.0.10 | CVEProject cvelistV5 (CNA) |
| Crestron | Crestron AirMedia, Barco WePresent, Extron ShareLink, Teq AV IT WIPS710, SHARP PN-L703WA, Optoma WPS-Pro, Blackbox HD WPS, InFocus LiteShow3, and InFocus LiteShow4. | Barco wePresent WiPG-1600W before firmware 2.4.1.19 | CVEProject cvelistV5 (CNA) |
| Crestron | Crestron AirMedia, Barco WePresent, Extron ShareLink, Teq AV IT WIPS710, SHARP PN-L703WA, Optoma WPS-Pro, Blackbox HD WPS, InFocus LiteShow3, and InFocus LiteShow4. | Blackbox HD WPS firmware 1.0.0.5 | CVEProject cvelistV5 (CNA) |
| Crestron | Crestron AirMedia, Barco WePresent, Extron ShareLink, Teq AV IT WIPS710, SHARP PN-L703WA, Optoma WPS-Pro, Blackbox HD WPS, InFocus LiteShow3, and InFocus LiteShow4. | Crestron AM-100 firmware 1.6.0.2 | CVEProject cvelistV5 (CNA) |
| Crestron | Crestron AirMedia, Barco WePresent, Extron ShareLink, Teq AV IT WIPS710, SHARP PN-L703WA, Optoma WPS-Pro, Blackbox HD WPS, InFocus LiteShow3, and InFocus LiteShow4. | Crestron AM-101 firmware 2.7.0.1 | CVEProject cvelistV5 (CNA) |
| Crestron | Crestron AirMedia, Barco WePresent, Extron ShareLink, Teq AV IT WIPS710, SHARP PN-L703WA, Optoma WPS-Pro, Blackbox HD WPS, InFocus LiteShow3, and InFocus LiteShow4. | Extron ShareLink 200/250 firmware 2.0.3.4 | CVEProject cvelistV5 (CNA) |
| Crestron | Crestron AirMedia, Barco WePresent, Extron ShareLink, Teq AV IT WIPS710, SHARP PN-L703WA, Optoma WPS-Pro, Blackbox HD WPS, InFocus LiteShow3, and InFocus LiteShow4. | InFocus LiteShow3 firmware 1.0.16 | CVEProject cvelistV5 (CNA) |
| Crestron | Crestron AirMedia, Barco WePresent, Extron ShareLink, Teq AV IT WIPS710, SHARP PN-L703WA, Optoma WPS-Pro, Blackbox HD WPS, InFocus LiteShow3, and InFocus LiteShow4. | Optoma WPS-Pro firmware 1.0.0.5 | CVEProject cvelistV5 (CNA) |
| Crestron | Crestron AirMedia, Barco WePresent, Extron ShareLink, Teq AV IT WIPS710, SHARP PN-L703WA, Optoma WPS-Pro, Blackbox HD WPS, InFocus LiteShow3, and InFocus LiteShow4. | SHARP PN-L703WA firmware 1.4.2.3 | CVEProject cvelistV5 (CNA) |
| Crestron | Crestron AirMedia, Barco WePresent, Extron ShareLink, Teq AV IT WIPS710, SHARP PN-L703WA, Optoma WPS-Pro, Blackbox HD WPS, InFocus LiteShow3, and InFocus LiteShow4. | Teq AV IT WIPS710 firmware 1.1.0.7 | CVEProject cvelistV5 (CNA) |
| Crestron | Crestron AirMedia, Barco WePresent, Extron ShareLink, Teq AV IT WIPS710, SHARP PN-L703WA, Optoma WPS-Pro, Blackbox HD WPS, InFocus LiteShow3, and InFocus LiteShow4. | and InFocus LiteShow4 2.0.0.7 | CVEProject cvelistV5 (CNA) |
منابع و راهنماها
۵- https://www.tenable.com/security/research/tra-2019-20 x_refsource_MISC
- https://www.exploit-db.com/exploits/46786/ exploitx_refsource_EXPLOIT-DB
- http://packetstormsecurity.com/files/152715/Barco-AWIND-OEM-Presentation-Platform-Unauthenticated-Remote-Command-Injection.html x_refsource_MISC
- http://packetstormsecurity.com/files/155948/Barco-WePresent-file_transfer.cgi-Command-Injection.html x_refsource_MISC
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-3929 government-resource
اطلاعات
- تاریخ انتشار
- ۱۳۹۸/۰۲/۱۱
- آخرین به‌روزرسانی
- ۱۴۰۴/۰۷/۳۰
- وضعیت
- PUBLISHED
- صادرکننده (CNA)
- tenable
- اولویت کلون
- به‌زودی
فهرست KEV آژانس CISA
- تاریخ افزوده‌شدن
- ۱۴۰۱/۰۱/۲۶
- مهلت رفع
- ۱۴۰۱/۰۲/۱۶
- استفاده در باج‌افزار
- نامشخص
پیش‌بینی بهره‌برداری (EPSS)
۹۸٫۹۵٪
احتمال بهره‌برداری در ۳۰ روز
۹۹٫۹٪
صدک (نسبت به همه‌ی CVEها)
ارزیابی SSVC (CISA)
- Automatable
- yes
- Exploitation
- active
- Technical Impact
- total
ضعف‌ها (CWE)
- CWE-79OS Command Injection