This would make it possible for attackers to co-opt the device for a persistent “beachhead” into the affected network, and launch attacks from an affected DGE-100. if credentials are not required for administrative access), anyone with the ability to connect to the device’s TCP port 41795 is effectively able to elevate to a root shell on the device. If default configuration is left in place (i.e. An example is shown below, where the device (at x.x.x.237) is induced to send the console service’s uid (root) to the attacker’s computer (at x.x.x.25), which is listening on port 80: However, DGE-100 devices do not require credentials for administrative access to the console service by default.īy connecting to this service with netcat and using the ping command with an argument constructed of shell-expandable variables, it is possible to inject operating system commands that will be executed by this console, which itself runs as root. The product manual for the Crestron DGE-100 describes a “Crestron console” service listening on TCP port 41795, which requires “a proprietary management tool” to use. It is being disclosed in accordance Rapid7's vulnerability disclosure policy. This issue was discovered by Rapid7 researchers Cale Black and Jordan Larose. Crestron Electronics distributes this device globally. The typical installation is a corporate meeting space or control room. More information about the device is available at the vendor's website. The Crestron Digital Graphics Engine 100 (DGE-100), is a hardware controller used to connect a touchscreen interface (commonly, a Crestron TSD-2220 HD touchscreen display) to external sources over HDMI, USB, or Ethernet.

Users should update their DGE-100 devices to the latest firmware version available here. DGE-100 devices running firmware versions 1.3384.00049.001 and lower with default configuration are vulnerable to CVE-2018-5553.ĬVE-2018-5553 is categorized as CWE-78 (Improper Neutralization of Special Elements used in an OS Command), and has a base CVSSv3 score of 9.8 (Critical).

Due to a lack of input sanitization, this service is vulnerable to command injection that can be used to gain root-level access.

This post describes CVE-2018-5553, a vulnerability in the Crestron Console service that is preinstalled on the DGE-100.

Crestron xpanel setup