CVE-2026-7865 | BDVDB-2026-330479 Detail
Crestron ElectronicsTouchpanels (x60/x70)
Description#
A hidden console command is vulnerable to command injection flaw when control characters are passed to its second argument. A third party researcher Eugene Lim had discovered vulnerability in the way console command passes to a popen function call. Attackers with authenticated access to SSH console of Crestron devices may use to run underlying OS commands.
Impact#
CAPEC-6 Argument Injection
Weaknesses#
- CWE-88 Improper neutralization of argument delimiters in a command ('argument injection')
References#
Exploit#
No public exploit known
History#
- Version 1Record published in the CVE List.
- Version 2Most recent update recorded in the CVE List.