CVE-2019-3929: Crestron Multiple Products Command Injection Vulnerability
- Is it exploited?
Yes. CISA added it to the Known Exploited Vulnerabilities catalog on , 1,081 days after the CVE record was published.
- How likely is exploitation in the next 30 days?
- 99%
EPSS score, percentile 99.9 of all scored records
- How severe?
- 9.8 Critical
CVSS v3.1 base score, from CISA's enrichment of the record
- What should I do?
CISA deadline . Apply updates per vendor instructions.
The CVE record links no vendor advisory, patch or mitigation.
- Which versions are affected?
Affected
- Crestron AM-100 firmware 1.6.0.2
- Crestron AM-101 firmware 2.7.0.1
- Barco wePresent WiPG-1000P firmware 2.3.0.10
- Barco wePresent WiPG-1600W before firmware 2.4.1.19
- Extron ShareLink 200/250 firmware 2.0.3.4
- Teq AV IT WIPS710 firmware 1.1.0.7
and 5 more in the table below
Source: CISA Known Exploited Vulnerabilities (KEV) catalog, 2026.10.28, as of ; FIRST Exploit Prediction Scoring System (EPSS), v2026.06.15, as of ; CVE List V5 (CVE Program), cve_2026-10-28_0000Z, as of . About the data.
What to do
Required action, set by CISA
Apply updates per vendor instructions.
CISA due date for this action: .
Advisories and patches
The CVE record links no vendor advisory, patch or mitigation.
Linked from CISA's catalog entry
Affected products and versions
As listed in the CVE record.
| Status | Versions |
|---|---|
| Affected | Crestron AM-100 firmware 1.6.0.2 |
| Affected | Crestron AM-101 firmware 2.7.0.1 |
| Affected | Barco wePresent WiPG-1000P firmware 2.3.0.10 |
| Affected | Barco wePresent WiPG-1600W before firmware 2.4.1.19 |
| Affected | Extron ShareLink 200/250 firmware 2.0.3.4 |
| Affected | Teq AV IT WIPS710 firmware 1.1.0.7 |
| Affected | SHARP PN-L703WA firmware 1.4.2.3 |
| Affected | Optoma WPS-Pro firmware 1.0.0.5 |
| Affected | Blackbox HD WPS firmware 1.0.0.5 |
| Affected | InFocus LiteShow3 firmware 1.0.16 |
| Affected | and InFocus LiteShow4 2.0.0.7 |
Source: CVE List V5 (CVE Program), cve_2026-10-28_0000Z, as of . About the data.
About this vulnerability
Multiple Crestron products are vulnerable to command injection via the file_transfer.cgi HTTP endpoint. A remote, unauthenticated attacker can use this vulnerability to execute operating system commands as root.
Summary: CISA's KEV catalog, as of .
- CISA added CVE-2019-3929 to its Known Exploited Vulnerabilities (KEV) catalog on 15 Apr 2022.
- CISA's ransomware flag for this entry is "Unknown": no evidence of ransomware use in the catalog, which is not proof of none.
- The due date CISA sets for the required action is 6 May 2022.
- The CVE record was published on 30 Apr 2019, 1,081 days before it was added to KEV.
- The CVE record carries a CVSS v3.1 base score of 9.8 (Critical), taken from CISA's enrichment of the record.
- FIRST's EPSS model puts the probability of exploitation in the next 30 days at 99% (percentile 99.9), as of 28 Oct 2026.
- CISA's SSVC assessment in the CVE record: exploitation active, automatable yes, technical impact total.
Source: CISA Known Exploited Vulnerabilities (KEV) catalog, 2026.10.28, as of ; CVE List V5 (CVE Program), cve_2026-10-28_0000Z, as of ; FIRST Exploit Prediction Scoring System (EPSS), v2026.06.15, as of . About the data.
Description
The Crestron AM-100 firmware 1.6.0.2, Crestron AM-101 firmware 2.7.0.1, Barco wePresent WiPG-1000P firmware 2.3.0.10, Barco wePresent WiPG-1600W before firmware 2.4.1.19, Extron ShareLink 200/250 firmware 2.0.3.4, Teq AV IT WIPS710 firmware 1.1.0.7, SHARP PN-L703WA firmware 1.4.2.3, Optoma WPS-Pro firmware 1.0.0.5, Blackbox HD WPS firmware 1.0.0.5, InFocus LiteShow3 firmware 1.0.16, and InFocus LiteShow4 2.0.0.7 are vulnerable to command injection via the file_transfer.cgi HTTP endpoint. A remote, unauthenticated attacker can use this vulnerability to execute operating system commands as root.
Source: CVE List V5 (CVE Program), cve_2026-10-28_0000Z, as of . About the data.
Weakness
- CWE-79: OS Command Injection
CWE and CAPEC are maintained by MITRE; the entries are those named in the CVE record and the KEV entry.
Timeline
| Date | Event |
|---|---|
| CVE record published | |
| Added to CISA KEV | |
| CISA due date for the required action | |
| CVE record last updated |