CVE-2018-5553 Crestron DGE-100 Console Command Injection (FIXED)
Attackers can inject commands via the console service to gain root access on Crestron AV devices.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2018-5553?
CVE-2018-5553 is a critical command injection vulnerability in Crestron DGE-100, published on 10 Jul 2018. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The Crestron Console service running on DGE-100, DM-DGE-200-C, and TS-1542-C devices with default configuration and running firmware versions 1.3384.00049.001 and lower are vulnerable to command injection that can be used to gain root-level access.
Weakness: CWE-78
Which versions are affected by CVE-2018-5553?
It affects 3 products.
Products include Crestron Dge-100 Firmware, Crestron Dm-Dge-200-C Firmware, Crestron Ts-1542-C Firmware.
How do I fix CVE-2018-5553?
No fix has been published for CVE-2018-5553 yet. Limit exposure of the affected software until one is available.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2018-5553 being exploited?
There is no known exploitation of CVE-2018-5553 in the wild and no public exploit code.
Sources
Also known as GHSA-chvw-4j9v-9x4r.