CVE-2019-3932

Vulnerability

Crestron AM-100 firmware 1.6.0.2 and AM-101 firmware 2.7.0.2 contain a hard-coded password in the return.tgi CGI script. This allows an unauthenticated remote attacker to bypass authentication controls without any required prior configuration or access [1].

Exploitation

An unauthenticated attacker can send crafted HTTP requests to the affected device over the network. By leveraging the hard-coded credential embedded in return.tgi, the attacker can bypass the authentication mechanism and directly interact with the UART bridge functionality without needing any user interaction or privileged access [1].

Impact

Successful exploitation enables the attacker to control external devices connected via the UART bridge, potentially leading to unauthorized manipulation of connected equipment such as displays or projectors. This can result in disclosure of sensitive information, disruption of service, or physical damage depending on the attached hardware. The attacker gains the same level of control as an authenticated administrator over the UART bridge feature [1].

Mitigation

Crestron has not released a firmware fix as of the publication date. Affected versions (AM-100 firmware 1.6.0.2, AM-101 firmware 2.7.0.2) remain vulnerable. Users are advised to restrict network access to the device, place it behind a firewall, and monitor for unauthorized access attempts. The device is not listed on CISA's Known Exploited Vulnerabilities (KEV) catalog as of this writing [1].