CVE-2025-47416
Description
A vulnerability exists in the ConsoleFindCommandMatchList function in libsymproc. so imported by ctpd that may lead to unauthorized execution of an attacker-defined file that gets prioritized by the ConsoleFindCommandMatchList. A third-party researcher discovered that the ConsoleFindCommandMatchList enumerates the /dev/shm/symproc/c directory in alphabetical order to identify console commands. Permission levels are inferred from the integer values present in each command's file name. Confirmed Affected Hardware: TSW-760, TSW-1060 Confirmed Affected Firmware: 3.002.1061 Fixed Firmware: no fixed released (product is discontinued and end of life) For x70 The Affected Firmware:- 3.000.0110.001 and versions below The Fixed Firmware:- 3.001.0031.001
How to fix
- CRESTRON TOUCHSCREEN x703.001.0031.001 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| CRESTRON TOUCHSCREEN x70 | 3.000.0110.001 ≤ v < 3.001.0031.001 | 3.001.0031.001 |
| CRESTRON Touchscreen x60s | 3.002.1061 | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.