HIGHCVE-2026-7865Published Modified CNA Crestron
CVE-2026-7865: Hidden Console Command
A hidden console command is vulnerable to command injection flaw when control characters are passed to its second argument. A third party researcher Eugene Lim had discovered vulnerability in the way console command passes to a popen function call. Attackers with authenticated access to SSH console of Crestron devices may use to run underlying OS commands.
Metrics
- CVSS v4.0
- 7.4
- Severity
- HIGH
- Fixed in
- —
- Affected Products
- 1
Affected packages
- Crestron Electronics / Touchpanels (x60/x70)≤ 3.003.0015.001
CVSS Vector
CVSS:4.0/AV:N/AC:H/AT:N/PR:H/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:NReferences