title: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in Crestron AM-300
description:
There is an OS command injection vulnerability in Crestron AM-300 firmware version 1.4499.00018 which may enable a user of a limited-access SSH session to escalate their privileges to root-level access.
problem types: CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
affected:
{
defaultStatus: unaffected
product: AM-300
vendor: Crestron
versions:
status: affected, version:  1.4499.00018
}
metrics:
cvssV3_1: [
attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 8.4
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
version: 3.1
]
format: CVSS
scenarios: GENERAL
solutions:
Crestron has resolved this vulnerability in firmware version 1.4499.00023.001 or higher. Please see  https://security.crestron.com https://security.crestron.com/  or contact True Blue Support for additional information.