CVE-2019-3936

Vulnerability

A denial-of-service vulnerability exists in the Crestron AM-100 (firmware 1.6.0.2) and AM-101 (firmware 2.7.0.2). By sending a crafted request to TCP port 389, the device's slideshow transitions into a "stopped" state. No authentication or prior access is required to trigger the vulnerable code path [1].

Exploitation

A remote, unauthenticated attacker can exploit this vulnerability by sending a specially crafted network request to TCP port 389 of the affected Crestron device. No credentials, user interaction, or special network position beyond reachability is needed. The request forces the slideshow to stop immediately [1].

Impact

Successful exploitation halts an active slideshow, denying service to legitimate users who rely on the presentation functionality. This is a denial-of-service (DoS) impact with no effect on confidentiality or integrity of other device functions [1].

Mitigation

Crestron has not released a firmware update for the AM-100 or AM-101 to address this vulnerability at the time of publication. Tenable’s advisory recommends restricting network access to port 389 and other management ports as a workaround. The devices may also be at end of life; operators should consider upgrading to supported models [1].