CVE-2026-7865
HIGH
7,4
Source: 25b0b659-c4b4-483f-aecb-067757d23ef3
Attack Vector: network
Attack Complexity: high
Privileges Required: high
User Interaction: none
Confidentiality: N/A
Integrity: N/A
Availability: N/A
Description
AI Translation Available
A hidden console command is vulnerable to command injection
flaw when control characters are passed to its second argument.
A third party researcher Eugene Lim had discovered vulnerability
in the way console command passes to a popen function call. Attackers with
authenticated access to SSH console of Crestron devices may use to run
underlying OS commands.
88
Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')
DraftCommon Consequences
Security Scopes Affected:
Confidentiality
Integrity
Availability
Other
Potential Impacts:
Execute Unauthorized Code Or Commands
Alter Execution Logic
Read Application Data
Modify Application Data
Applicable Platforms
Languages:
Not Language-Specific, PHP
https://www.crestron.com/release_notes/tsw-xx70_3.003.0015.001_release_notes.pdf
https://www.crestron.com/Software-Firmware/Firmware/Touchpanels/TS-770-TS-1070-…