CVE-2019-3930
Description
The Crestron AM-100 firmware 1.6.0.2, Crestron AM-101 firmware 2.7.0.1, Barco wePresent WiPG-1000P firmware 2.3.0.10, Barco wePresent WiPG-1600W before firmware 2.4.1.19, Extron ShareLink 200/250 firmware 2.0.3.4, Teq AV IT WIPS710 firmware 1.1.0.7, SHARP PN-L703WA firmware 1.4.2.3, Optoma WPS-Pro firmware 1.0.0.5, Blackbox HD WPS firmware 1.0.0.5, InFocus LiteShow3 firmware 1.0.16, and InFocus LiteShow4 2.0.0.7 are vulnerable to a stack buffer overflow in libAwgCgi.so's PARSERtoCHAR function. A remote, unauthenticated attacker can use this vulnerability to execute arbitrary code as root via a crafted request to the return.cgi endpoint.
How to fix
- barco wepresent_wipg-1600w_firmware2.4.1.19 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| crestron am-100_firmware | 1.6.0.2 | — |
| crestron am-101_firmware | 2.7.0.2 | — |
| barco wepresent_wipg-1000p_firmware | 2.3.0.10 | — |
| barco wepresent_wipg-1600w_firmware | v < 2.4.1.19 | 2.4.1.19 |
| extron sharelink_200_firmware | 2.0.3.4 | — |
| extron sharelink_250_firmware | 2.0.3.4 | — |
| teqavit wips710_firmware | 1.1.0.7 | — |
| sharp pn-l703wa_firmware | 1.4.2.3 | — |
| optoma wps-pro_firmware | 1.0.0.5 | — |
| blackbox hd_wireless_presentation_system_firmware | 1.0.0.5 | — |
| infocus liteshow3_firmware | 1.0.16 | — |
| infocus liteshow4_firmware | 2.0.0.7 | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.