PT-2026-37084
CVE-2026-7865
·
Published
2026-05-05
·
Updated
2026-05-08
Description by
CVSS 4.0
7.4
HighMetricsAV:N/AC:H/AT:N/PR:H/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Name of the Vulnerable Software and Affected Versions
Crestron devices (affected versions not specified)
Description
A hidden console command contains a command injection flaw occurring when control characters are passed to its second argument. This issue exists in the way the console command is passed to the
popen() function. Authenticated attackers with SSH console access can exploit this to execute underlying operating system commands.Recommendations
At the moment, there is no information about a newer version that contains a fix for this vulnerability.
Found an issue in the description? Have something to add? Feel free to write us 👾