CVE-2019-3929
Description
The Crestron AM-100 firmware 1.6.0.2, Crestron AM-101 firmware 2.7.0.1, Barco wePresent WiPG-1000P firmware 2.3.0.10, Barco wePresent WiPG-1600W before firmware 2.4.1.19, Extron ShareLink 200/250 firmware 2.0.3.4, Teq AV IT WIPS710 firmware 1.1.0.7, SHARP PN-L703WA firmware 1.4.2.3, Optoma WPS-Pro firmware 1.0.0.5, Blackbox HD WPS firmware 1.0.0.5, InFocus LiteShow3 firmware 1.0.16, and InFocus LiteShow4 2.0.0.7 are vulnerable to command injection via the file_transfer.cgi HTTP endpoint. A remote, unauthenticated attacker can use this vulnerability to execute operating system commands as root.
How to fix
Apply updates per vendor instructions.
CISA due date: May 6, 2022- barco wepresent_wipg-1600w_firmware2.4.1.19 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| crestron am-100_firmware | 1.6.0.2 | — |
| crestron am-101_firmware | 2.7.0.2 | — |
| barco wepresent_wipg-1000p_firmware | 2.3.0.10 | — |
| barco wepresent_wipg-1600w_firmware | v < 2.4.1.19 | 2.4.1.19 |
| extron sharelink_200_firmware | 2.0.3.4 | — |
| extron sharelink_250_firmware | 2.0.3.4 | — |
| teqavit wips710_firmware | 1.1.0.7 | — |
| sharp pn-l703wa_firmware | 1.4.2.3 | — |
| optoma wps-pro_firmware | 1.0.0.5 | — |
| blackbox hd_wireless_presentation_system_firmware | 1.0.0.5 | — |
| infocus liteshow3_firmware | 1.0.16 | — |
| infocus liteshow4_firmware | 2.0.0.7 | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.