Vulnerability · Published Sep 9, 2025 · Assigned by Crestron
CVE-2025-47416ConsoleFindCommandMatchList
Medium 5.9
In plain English
A medium-severity security flaw in Touchscreen x60s from CRESTRON. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 31% of all known vulnerabilities).
Official description
A vulnerability exists in the ConsoleFindCommandMatchList function in libsymproc. so imported by ctpd that may lead to unauthorized execution of an attacker-defined file that gets prioritized by the ConsoleFindCommandMatchList. A third-party researcher discovered that the ConsoleFindCommandMatchList enumerates the /dev/shm/symproc/c directory in alphabetical order to identify console commands. Permission levels are inferred from the integer values present in each command's file name. Confirmed Affected Hardware: TSW-760, TSW-1060 Confirmed Affected Firmware: 3.002.1061 Fixed Firmware: no fixed released (product is discontinued and end of life) For x70 The Affected Firmware:- 3.000.0110.001 and versions below The Fixed Firmware:- 3.001.0031.001
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| CRESTRON | TOUCHSCREEN x70 | 3.000.0110.001 – before 3.001.0031.001 |
| CRESTRON | Touchscreen x60s | 3.002.1061 |
Weakness: CWE-697 · Vector: CVSS:4.0/AV:N/AC:H/AT:N/PR:H/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N