{"id":"CVE-2026-7865","state":"PUBLISHED","title":"Hidden Console Command","description":"A hidden console command is vulnerable to command injection\nflaw when control characters are passed to its second argument. \n\nA third party researcher Eugene Lim had discovered vulnerability\nin the way console command passes to a popen function call. Attackers with\nauthenticated access to SSH console of Crestron devices may use to run\nunderlying OS commands.","publishedAt":"2026-05-05T15:05:12.734Z","updatedAt":"2026-05-06T15:25:23.058Z","severity":{"score":7.4,"label":"High","version":"4.0","vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:H/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","source":"Crestron"},"assigner":"Crestron","products":["Crestron Electronics Touchpanels (x60/x70)"],"affected":[{"vendor":"Crestron Electronics","product":"Touchpanels (x60/x70)","defaultStatus":"unaffected","versions":[{"version":"3.002.0043.001","status":"affected","lessThanOrEqual":"3.003.0015.001","changes":[{"at":"3.003.0015.001","status":"unaffected"}],"versionType":"custom"}]}],"references":["https://www.crestron.com/Software-Firmware/Firmware/Touchpanels/TS-770-TS-1070-TSS-770-TSS-1070-TSW-570/3-003-0015-001","https://www.crestron.com/release_notes/tsw-xx70_3.003.0015.001_release_notes.pdf"],"weaknesses":["CWE-88"],"ingestedAt":"2026-10-29T20:13:07.220Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/7xxx/CVE-2026-7865.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-7865","state":"PUBLISHED","datePublished":"2026-05-05T15:05:12.734Z","dateUpdated":"2026-05-06T15:25:23.058Z","assignerShortName":"Crestron","assignerOrgId":"25b0b659-c4b4-483f-aecb-067757d23ef3","dateReserved":"2026-05-05T13:36:54.938Z"},"containers":{"cna":{"title":"Hidden Console Command","descriptions":[{"lang":"en","value":"A hidden console command is vulnerable to command injection\nflaw when control characters are passed to its second argument. \n\nA third party researcher Eugene Lim had discovered vulnerability\nin the way console command passes to a popen function call. Attackers with\nauthenticated access to SSH console of Crestron devices may use to run\nunderlying OS commands."}],"affected":[{"vendor":"Crestron Electronics","product":"Touchpanels (x60/x70)","defaultStatus":"unaffected","versions":[{"version":"3.002.0043.001","status":"affected","lessThanOrEqual":"3.003.0015.001","changes":[{"at":"3.003.0015.001","status":"unaffected"}],"versionType":"custom"}]}],"references":[{"url":"https://www.crestron.com/Software-Firmware/Firmware/Touchpanels/TS-770-TS-1070-TSS-770-TSS-1070-TSW-570/3-003-0015-001","tags":["patch"]},{"url":"https://www.crestron.com/release_notes/tsw-xx70_3.003.0015.001_release_notes.pdf","tags":["release-notes"]}],"metrics":[{"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}],"cvssV4_0":{"attackVector":"NETWORK","attackComplexity":"HIGH","attackRequirements":"NONE","privilegesRequired":"HIGH","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","subConfidentialityImpact":"NONE","vulnIntegrityImpact":"HIGH","subIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED","version":"4.0","baseSeverity":"HIGH","baseScore":7.4,"vectorString":"CVSS:4.0/AV:N/AC:H/AT:N/PR:H/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-88","lang":"en","description":"CWE-88 Improper neutralization of argument delimiters in a command ('argument injection')","type":"CWE"}]}],"providerMetadata":{"shortName":"Crestron","orgId":"25b0b659-c4b4-483f-aecb-067757d23ef3","dateUpdated":"2026-05-05T15:05:12.734Z"},"datePublic":"2026-05-05T14:10:00.000Z","impacts":[{"capecId":"CAPEC-6","descriptions":[{"lang":"en","value":"CAPEC-6 Argument Injection"}]}],"source":{"discovery":"EXTERNAL"},"x_generator":{"engine":"Vulnogram 1.0.2"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2026-05-05T18:31:34.690899Z","id":"CVE-2026-7865","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-05-06T15:25:23.058Z"}}]}}}