Threat database

CVE-2026-7865 is a command injection vulnerability in Crestron Electronics Touchpanels (x60/x70) firmware version 3.002.0043.001. The flaw exists in a hidden console command that improperly neutralizes argument delimiters when passing control characters to its second argument, allowing command injection. An attacker with authenticated SSH console access could exploit this to execute arbitrary OS commands. The vulnerability has a high severity score of 7.4. No official patch or remediation guidance has been published yet.