CVE-2019-3929VulnerabilityPublished 04/15/2022Updated 10/24/2026

CVE-2019-3929: Crestron Multiple Products Command Injection Vulnerability

Affects Crestron Multiple ProductsSource CISA KEV

Severity

High

No CVSS score published yet

Exploitation: Actively exploited – in CISA KEV since 04/15/2022
KEV deadline: 05/06/2022
EPSS: 99.0% chance of exploitation in 30 days – higher than 99% of CVEs

What to do

CISA required action

Apply updates per vendor instructions.

nvd.nist.gov/vuln/detail/CVE-2019-3929 (opens in a new tab)

Description

Multiple Crestron products have a command injection vulnerability via the file_transfer.cgi HTTP endpoint. This flaw allows a remote, unauthenticated attacker to execute operating system commands with root privileges. The vulnerability has been exploited in the wild. No specific affected versions or patches are provided in the available data.

Summary

CVE-2019-3929 describes a command injection vulnerability affecting multiple Crestron products. The vulnerability exists in the file_transfer.cgi HTTP endpoint, which can be exploited remotely without authentication. Successful exploitation enables an attacker to execute arbitrary OS commands as root, posing a critical risk to affected systems. The vulnerability has been observed in active exploitation campaigns. No vendor advisory or patch information is provided in the input data.

Impact

An unauthenticated remote attacker can execute arbitrary operating system commands with root privileges on affected Crestron devices. This can lead to full system compromise, unauthorized control, and potential disruption of services. The vulnerability has been exploited in the wild, indicating active threat activity targeting these products.

Mitigation

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict network access to the affected devices and monitor for suspicious activity targeting the file_transfer.cgi endpoint.

Weaknesses

CWE-79Cross-Site Scripting (XSS) (opens in a new tab)

What to do

Description

AnalysisAI-generated, updated 10/24/2026, 11:27:00 UTC

Weaknesses

References

Related threats