CVE-2017-16709: Crestron AirMedia firmware allows authenticated admin remote code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: medium.

high priorityCVSS 7.2 with high EPSS and full code execution impact, though exploitation requires existing admin credentials and no public exploit is confirmed.

What it is

Crestron AirMedia AM-100 (firmware before 1.6.0) and AM-101 (firmware before 2.7.0) contain a flaw that lets a remote authenticated administrator execute arbitrary code. The exact vulnerable component and attack vectors are unspecified in the record, but the impact is full compromise of the device.

Impact

An attacker with administrative credentials gains code execution on the AirMedia device, leading to full loss of confidentiality, integrity and availability of that system. From there the device could be used as a foothold into the network segment it sits on.

Attack surface

Reachable over the network (AV:N) with low attack complexity, but it requires high privileges (PR:H) and no user interaction (UI:N). The attacker must already hold valid administrative credentials on the device.

Exploitation

Not listed in CISA KEV and no ransomware association is documented. EPSS is high (0.71963, 99.4th percentile), but the references carry only Vendor Advisory and Third Party Advisory tags, so no public exploit is confirmed by this record.

What to do

• Upgrade AM-100 to firmware 1.6.0 or later and AM-101 to firmware 2.7.0 or later.
• Restrict administrative access to AirMedia devices to a dedicated management VLAN or trusted hosts.
• Enforce strong, unique admin credentials and rotate them; avoid shared or default accounts.
• Monitor vendor advisories for further detail on the vulnerable component and any interim workarounds.

Detection

• Alert on administrative logins to AirMedia devices from unexpected source IPs or outside maintenance windows.
• Monitor device logs and network traffic for unexpected outbound connections or process activity following admin sessions.
• Baseline normal admin activity per device and flag deviations such as new accounts, config changes or firmware writes.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.