CVE-2019-3929The Crestron AM-100 firmware 1.6.0.2, Crestron AM-101 firmware 2.7.0.1, Barco wePresent WiPG-1000P firmware 2.3.0.10, Barco wePresent WiPG-1600W before firmware 2.4.1.19, Extron ShareLink 200/250 fir…
Updated under an hour ago ()
Does this affect you?
It affects Crestron AirMedia, Barco WePresent, Extron ShareLink, Teq AV IT WIPS710, SHARP PN-L703WA, Optoma WPS-Pro, Blackbox HD WPS, InFocus LiteShow3, and InFocus LiteShow4. and 12 other products. Add what you run to find out whether that includes you.
CISA lists it as known exploited since Apr 15, 2022; federal agencies had to remediate by May 6, 2022. Treat that date as your deadline.
The Crestron AM-100 firmware 1.6.0.2, Crestron AM-101 firmware 2.7.0.1, Barco wePresent WiPG-1000P firmware 2.3.0.10, Barco wePresent WiPG-1600W before firmware 2.4.1.19, Extron ShareLink 200/250 firmware 2.0.3.4, Teq AV IT WIPS710 firmware 1.1.0.7, SHARP PN-L703WA firmware 1.4.2.3, Optoma WPS-Pro firmware 1.0.0.5, Blackbox HD WPS firmware 1.0.0.5, InFocus LiteShow3 firmware 1.0.16, and InFocus LiteShow4 2.0.0.7 are vulnerable to command injection via the file_transfer.cgi HTTP endpoint. A remote, unauthenticated attacker can use this vulnerability to execute operating system commands as root.
- CVSS
- 9.8 CRITICAL (v3.1, CISA ADP)CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Weakness (CWE)
- CWE-79
- Known exploited
- Added to CISA KEV Apr 15, 2022; federal remediation due May 6, 2022Apply updates per vendor instructions.
- EPSS (exploitation in the next 30 days)
- 98.95% (percentile 100)
- Assigned by
- tenable
- NVD analysis
- Analyzed
- Record last updated
- Oct 21, 2025
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Crestron Crestron AirMedia, Barco WePresent, Extron ShareLink, Teq AV IT WIPS710, SHARP PN-L703WA, Optoma WPS-Pro, Blackbox HD WPS, InFocus LiteShow3, and InFocus LiteShow4. crestron:airmedia_barco_wepresent_extron_sharelink_teq_av_it_wips710_sharp_pn_l703wa_optoma_wps_pro_blackbox_hd_wps_infocus_liteshow3_and_infocus_liteshow4 (from the name) | Crestron AM-100 firmware 1.6.0.2; Crestron AM-101 firmware 2.7.0.1; Barco wePresent WiPG-1000P firmware 2.3.0.10; Barco wePresent WiPG-1600W before firmware 2.4.1.19; Extron ShareLink 200/250 firmware 2.0.3.4; Teq AV IT WIPS710 firmware 1.1.0.7; SHARP PN-L703WA firmware 1.4.2.3; Optoma WPS-Pro firmware 1.0.0.5; and 3 more ranges | CNA record |
crestron am-100_firmware crestron:am-100_firmware | 1.6.0.2 | NVD |
crestron am-101_firmware crestron:am-101_firmware | 2.7.0.2 | NVD |
barco wepresent_wipg-1000p_firmware barco:wepresent_wipg-1000p_firmware | 2.3.0.10 | NVD |
barco wepresent_wipg-1600w_firmware barco:wepresent_wipg-1600w_firmware | before 2.4.1.19 | NVD |
extron sharelink_200_firmware extron:sharelink_200_firmware | 2.0.3.4 | NVD |
extron sharelink_250_firmware extron:sharelink_250_firmware | 2.0.3.4 | NVD |
teqavit wips710_firmware teqavit:wips710_firmware | 1.1.0.7 | NVD |
sharp pn-l703wa_firmware sharp:pn-l703wa_firmware | 1.4.2.3 | NVD |
optoma wps-pro_firmware optoma:wps-pro_firmware | 1.0.0.5 | NVD |
blackbox hd_wireless_presentation_system_firmware blackbox:hd_wireless_presentation_system_firmware | 1.0.0.5 | NVD |
infocus liteshow3_firmware infocus:liteshow3_firmware | 1.0.16 | NVD |
infocus liteshow4_firmware infocus:liteshow4_firmware | 2.0.0.7 | NVD |
References
- https://www.tenable.com/security/research/tra-2019-20x-refsource-misc, exploit, third-party-advisory
- https://www.exploit-db.com/exploits/46786/exploit, x-refsource-exploit-db, third-party-advisory, vdb-entry
- http://packetstormsecurity.com/files/152715/Barco-AWIND-OEM-Presentation-Platform-Unauthenticated-Remote-Command-Injection.htmlx-refsource-misc, third-party-advisory, vdb-entry
- http://packetstormsecurity.com/files/155948/Barco-WePresent-file_transfer.cgi-Command-Injection.htmlx-refsource-misc, third-party-advisory, vdb-entry
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-3929us-government-resource
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.