Vulnerability · Published Sep 3, 2025 · Assigned by Crestron
CVE-2025-47421Privilege escalation via SCP login
High 8.6
In plain English
A high-severity argument injection in TOUCHSCREENS x70 from CRESTRON. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 32% of all known vulnerabilities).
Official description
Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') vulnerability in CRESTRON TOUCHSCREENS x70 allows Argument Injection.This issue affects TOUCHSCREENS x70: from 3.001.0031.001 through 3.001.0034.001. A specially crafted SCP command sent via SSH login string can lead a valid administrator user to gain Privileged Operating System access on the device. Following Products Models are affected: TSW-x70 TSW-x60 TST-1080 AM-3000/3100/3200 Soundbar VB70 HD-PS622/621/402 HD-TXU-RXU-4kZ-211 HD-MDNXM-4KZ-E *Note: additional firmware updates will be published once made available
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| CRESTRON | TOUCHSCREENS x70 | 3.001.0031.001 – before 3.001.0034.001 |
Weakness: CWE-88 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N