CVE-2019-3929

Crestron products allow remote, unauthenticated attackers to execute OS commands as root via command injection on the file_transfer.cgi endpoint.

A remote, unauthenticated attacker can exploit this command injection flaw to run arbitrary OS commands with root privileges, enabling full system compromise and lateral movement. For DIB organizations, this represents a critical RCE vulnerability that bypasses authentication controls and violates CMMC/NIST 800-171 requirements for protecting systems and information. Organizations must immediately patch Crestron products and restrict network access to unpatched systems.

Shame score — A remote, unauthenticated command injection flaw allowing root-level OS command execution is a severe, avoidable vulnerability that was actively exploited in the wild.