Crestron, Barco, Extron Wireless Presentation Systems Remote Code Execution Vulnerability (CVE-2019-3929)
Executive & SecOps Summary
SECOPS ASSESSMENTWireless presentation gateways based on the AWIND OEM platform, including Crestron AM-100/101, Barco wePresent WiPG-1000P/1600W, and Extron ShareLink 200/250.
An unauthenticated remote attacker can execute arbitrary operating system commands with root privileges via crafted HTTP requests.
Apply the latest firmware updates from the respective vendors and restrict network access to the device management interfaces.
Affected Products & Version Scope
Remediation & Live Workaround Commands
PATCH & WORKAROUND1. Official Patch & Version Upgrade Commands
Refer to the official security advisories of your respective hardware vendor (Crestron, Barco, Extron, etc.) to download and flash the patched firmware version.
2. Temporary Workaround & Hardening Configuration
If immediate patching is not feasible, restrict access to the web management interface (ports 80 and 443) using network firewalls or access control lists (ACLs).
# Example: Restrict access to the web interface to a trusted management subnet (e.g., 10.0.0.0/24)
iptables -A INPUT -p tcp -s 10.0.0.0/24 --dport 80 -j ACCEPT
iptables -A INPUT -p tcp -s 10.0.0.0/24 --dport 443 -j ACCEPT
iptables -A INPUT -p tcp --dport 80 -j DROP
iptables -A INPUT -p tcp --dport 443 -j DROP3. Log Audit & IoC Verification Commands
Scan your web server access logs or network traffic for suspicious requests targeting the file_transfer.cgi endpoint containing shell metacharacters.
# Search for suspicious file_transfer.cgi requests in web access logs
grep -i 'file_transfer.cgi' /var/log/nginx/access.log | grep -E '(\||;|\&|\`|\$)'Stop Exposing VPN Ports to the Internet — Switch to Zero-Trust Access
Eliminate public-facing VPN concentrators and firewall management ports with identity-first Zero-Trust Network Access.
Technical Root Cause & Exploitation Mechanics
1. Vulnerability Overview & Root Cause
This vulnerability is an OS command injection flaw found in multiple wireless presentation gateway devices built on the AWIND OEM platform. The root cause lies in the lack of proper input validation and sanitization of user-supplied parameters within the file_transfer.cgi web endpoint. When the CGI script processes incoming HTTP requests, it passes unsanitized input directly to a system shell, allowing command injection.
2. Exploitation Mechanics & Attack Scenario
An attacker can exploit this vulnerability by sending a specially crafted HTTP POST request to the target device's /cgi-bin/file_transfer.cgi endpoint. By embedding shell metacharacters (such as ;, &, or backticks) into the parameters, the attacker can append arbitrary OS commands. Because the endpoint does not require authentication, any remote attacker with network access to the device can execute commands as the root user.
3. Infrastructure & Business Impact
Since these presentation systems are typically deployed within corporate meeting rooms and internal enterprise networks, successful exploitation provides attackers with an initial foothold inside the network. Attackers can leverage root access to exfiltrate sensitive presentation data, sniff local network traffic, or perform lateral movement to compromise other critical internal systems. This vulnerability is actively exploited in the wild and is listed in the CISA KEV catalog.
Official Vendor Advisories & References
The Crestron AM-100 firmware 1.6.0.2, Crestron AM-101 firmware 2.7.0.1, Barco wePresent WiPG-1000P firmware 2.3.0.10, Barco wePresent WiPG-1600W before firmware 2.4.1.19, Extron ShareLink 200/250 firmware 2.0.3.4, Teq AV IT WIPS710 firmware 1.1.0.7, SHARP PN-L703WA firmware 1.4.2.3, Optoma WPS-Pro firmware 1.0.0.5, Blackbox HD WPS firmware 1.0.0.5, InFocus LiteShow3 firmware 1.0.16, and InFocus LiteShow4 2.0.0.7 are vulnerable to command injection via the file_transfer.cgi HTTP endpoint. A remote, unauthenticated attacker can use this vulnerability to execute operating system commands as root.
Frequently Asked SecOps Questions (CVE-2019-3929)
FAQQ1. How critical is CVE-2019-3929 and is it actively exploited in the wild?
CVE-2019-3929 is rated CVSS 9.8 (CRITICAL) with a 30-day EPSS exploitation probability of 99.0%. It is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, requiring immediate emergency remediation.
Q2. Which vendors and products are affected by CVE-2019-3929?
Primary impacted vendors include crestron, barco, extron, teq av it, sharp, optoma, blackbox, infocus across am-100, am-101, wipg-1000p, wipg-1600w, sharelink 200, sharelink 250, wips710, pn-l703wa, wps-pro, hd wps, liteshow3, liteshow4. Scope summary: Crestron AM-100 (1.6.0.2), AM-101 (2.7.0.1), Barco wePresent WiPG-1000P (2.3.0.10), WiPG-1600W (prior to 2.4.1.19), Extron ShareLink 200/250 (2.0.3.4), and other AWIND OEM-based devices.
Q3. What temporary mitigations or workarounds exist for CVE-2019-3929 before patching?
[Mitigation] Apply the latest firmware updates from the respective vendors and restrict network access to the device management interfaces. Follow the CLI remediation commands and interactive SecOps checklist on this page to restrict exposure prior to your maintenance window.
Generate an Internal Engineering Notice or CISO Report for CVE-2019-3929
Instantly format this advisory into an executive CISO summary or engineering patch ticket.
🔗 Related Advisories in Similar Stack (crestron)
View Category →Arista VeloCloud Orchestrator (VCO) On-Premises Remote Code Execution and Privilege Bypass (CVE-2026-16812)
[Affected Scope] On-premises deployments of VeloCloud Orchestrator (VCO)
Ivanti Sentry OS Command Injection and Remote Code Execution (RCE) Vulnerability Advisory (CVE-2026-10520)
[Affected Scope] Ivanti Sentry versions prior to R10.5.2, R10.6.2, and R10.7.1
Fortinet FortiSandbox OS Command Injection Vulnerability (CVE-2026-25089) Security Advisory
[Affected Scope] Fortinet FortiSandbox (5.0.0 to 5.0.5, 4.4.0 to 4.4.8, 4.2 all versions), FortiSandbox Cloud and PaaS (5.0.4 to 5.0.5)
Fortinet FortiSandbox OS Command Injection Vulnerability (CVE-2026-39808) Advisory
[Affected Scope] Fortinet FortiSandbox versions 4.4.0 through 4.4.8
Subscribe to Daily Vulnerability Briefings & KEV Alerts
Concise morning briefings for SecOps, DevSecOps, and SRE teams covering newly exploited CVEs and mitigation priorities.