Crestron vulnerabilities
We track 7 vulnerabilities in Crestron products across 9 products. 7 are rated high or critical, and 1 has been exploited in real attacks. The most recent was published on September 3, 2025.
Latest Crestron vulnerabilities
- 8.6 High severity
TOUCHSCREENS x70: Improper Neutralization of Argument Delimiters in a Command
Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') vulnerability in CRESTRON TOUCHSCREENS x70 allows Argument Injection.This issue affects TOUCHSCREENS x70: from 3.001.0031.001 through 3.001.0034.001. A specially crafted SCP com
- 10.0 Critical severity
Automate VX: Cleartext Transmission of Sensitive Information
Cleartext Transmission of Sensitive Information vulnerability in Crestron Automate VX allows Sniffing Network Traffic. The device allows Web UI and API access over non-secure network ports which exposes sensitive information such as user passwords. This issue
- 7.8 High severity
AM-300: Improper Neutralization of Special Elements used in an OS Command
There is an OS command injection vulnerability in Crestron AM-300 firmware version 1.4499.00018 which may enable a user of a limited-access SSH session to escalate their privileges to root-level access.
- 8.8 High severity
Airmedia: Incorrect Permission Assignment for Critical Resource
Crestron AirMedia for Windows before 5.5.1.84 has insecure inherited permissions, which leads to a privilege escalation vulnerability found in the AirMedia Windows Application, version 4.3.1.39. A low privileged user can initiate a repair of the system and gai
- 7.8 High severity
Airmedia: Uncontrolled Search Path Element
A vulnerability was discovered in the Crestron AirMedia Windows Application, version 4.3.1.39, in which a user can place a malicious DLL in a certain path to execute code and preform a privilege escalation attack.
- 9.8 Critical severity
Hd-md4x2-4k-e Firmware: Improper Authentication
An issue was discovered on Crestron HD-MD4X2-4K-E 1.0.0.2159 devices. When the administrative web interface of the HDMI switcher is accessed unauthenticated, user credentials are disclosed that are valid to authenticate to the web interface. Specifically, aj.h
- 9.8 Critical severity
Crestron Multiple Products Command Injection Exploited
The Crestron AM-100 firmware 1.6.0.2, Crestron AM-101 firmware 2.7.0.1, Barco wePresent WiPG-1000P firmware 2.3.0.10, Barco wePresent WiPG-1600W before firmware 2.4.1.19, Extron ShareLink 200/250 firmware 2.0.3.4, Teq AV IT WIPS710 firmware 1.1.0.7, SHARP PN-L