CVE-2019-3926

Vulnerability

CVE-2019-3926 is a command injection vulnerability in the SNMP implementation of the Crestron AM-100 (firmware 1.6.0.2) and AM-101 (firmware 2.7.0.2). The vulnerability lies in the handling of the SNMP OID iso.3.6.1.4.1.3212.100.3.2.14.1. When this OID is queried, the device shells out to /bin/getRemoteURL.sh without properly sanitizing user-supplied input, allowing arbitrary operating system commands to be injected [1].

Exploitation

An attacker can exploit this vulnerability by sending a crafted SNMP request to the targeted device. The attack does not require authentication and can be performed remotely over the network. The attacker must be able to reach the SNMP service (typically UDP port 161) on the device. By setting the value of the specific OID to include command injection payloads (e.g., using backticks or semicolons), the injected commands are executed in the context of the /bin/getRemoteURL.sh script [1].

Impact

Successful exploitation allows a remote, unauthenticated attacker to execute arbitrary operating system commands with root privileges. This gives the attacker full control over the affected Crestron device, enabling actions such as modifying system configuration, exfiltrating data, installing malware, or pivoting to other internal network resources [1].

Mitigation

Crestron released firmware updates to address this vulnerability. Users should update the AM-100 to firmware version 1.6.0.3 or later, and the AM-101 to firmware version 2.7.0.3 or later. If updating is not immediately possible, restricting SNMP access to trusted hosts via firewall rules and disabling SNMP community strings if not needed can reduce the attack surface [1].