Lucene search

IcscertCVE-2023-6926

HistoryJan 23, 2024 - 8:15 p.m.

CVE-2023-6926

2024-01-2320:15:45

CWE-78

icscert

web.nvd.nist.gov

cve-2023-6926

os command injection

crestron am-300

firmware vulnerability

privilege escalation

CVSS3

8.4

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

7.9

Confidence

High

EPSS

Percentile

9.5%

JSON

There is an OS command injection vulnerability in Crestron AM-300 firmware version 1.4499.00018 which may enable a user of a limited-access SSH session to escalate their privileges to root-level access.

Affected configurations

Nvd

Node

crestronam-300Match-

AND

crestronam-300_firmwareMatch1.4499.00018

VendorProductVersionCPE
crestronam-300-cpe:2.3:h:crestron:am-300:-:*:*:*:*:*:*:*
crestronam-300_firmware1.4499.00018cpe:2.3:o:crestron:am-300_firmware:1.4499.00018:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
crestron	am-300	-	cpe:2.3:h:crestron:am-300:-:::::::*
crestron	am-300_firmware	1.4499.00018	cpe:2.3:o:crestron:am-300_firmware:1.4499.00018:::::::*

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "product": "AM-300",
    "vendor": "Crestron",
    "versions": [
      {
        "status": "affected",
        "version": " 1.4499.00018"
      }
    ]
  }
]

References

www.cisa.gov/news-events/ics-advisories/icsa-24-023-02

CVSS3

8.4

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

7.9

Confidence

High

EPSS

Percentile

9.5%

JSON

Related for CVE-2023-6926