CVE-2019-3929: Unauthenticated OS command injection in Crestron, Barco and other wireless presentation firmware

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 16 September 2026. Confidence: high.

critical priorityCVSS 9.8, unauthenticated remote root command execution, active inclusion in CISA KEV, and near-maximum EPSS probability make this a top remediation priority.

What it is

Multiple wireless presentation and collaboration devices (Crestron AM-100/AM-101, Barco wePresent, Extron ShareLink, Teq AV IT, SHARP, Optoma, Blackbox and InFocus models) expose a file_transfer.cgi HTTP endpoint that fails to sanitize input, allowing OS command injection. Because the endpoint is reachable without authentication, any network-adjacent attacker can run arbitrary commands as root on the device.

Impact

An attacker gains root-level command execution on the affected device, enabling full compromise of the appliance, data theft, and use as a pivot into the internal network.

Attack surface

Reachable over the network via the file_transfer.cgi HTTP endpoint; the CVSS vector (AV:N/AC:L/PR:N/UI:N) and description confirm no authentication or user interaction is required.

Exploitation

Listed in CISA KEV since 2022-04-15 with a required action to apply vendor updates, and EPSS shows a 30-day probability of 0.98952 (99.9th percentile); public exploit references exist (Exploit-DB 46786, Tenable TRA-2019-20).

What to do

• Apply the latest firmware updates from each affected vendor (Crestron, Barco, Extron, Teq AV IT, SHARP, Optoma, Blackbox, InFocus) as directed by CISA KEV.
• If patching is not immediately possible, isolate affected presentation devices on a dedicated VLAN with no access to internal corporate networks.
• Block or restrict access to the file_transfer.cgi endpoint at the network perimeter and from untrusted segments.
• Disable or remove unused wireless presentation features and remote management interfaces until patched.
• Monitor vendor advisories for updated firmware versions and re-verify device firmware after remediation.

Detection

• Inspect HTTP logs for requests to /file_transfer.cgi, especially with shell metacharacters or unusual parameters.
• Monitor device and network logs for unexpected outbound connections or command execution artifacts from presentation appliances.
• Use network monitoring to detect anomalous traffic from presentation devices to internal hosts or the internet.
• Audit firmware versions of all listed devices against vendor-patched releases.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.