Reference page — cumulative record through Wednesday, October 7, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.

CVE-2019-3929

CVE-2019-3929CRITICAL

Crestron Multiple Products

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   N   N  U  H  H  H    9.8   .9895   99.9   YES

AFFECTED
  Product                                                                                                                                                               Versions                            Fixed
  Crestron AirMedia, Barco WePresent, Extron ShareLink, Teq AV IT WIPS710, SHARP PN-L703WA, Optoma WPS-Pro, Blackbox HD WPS, InFocus LiteShow3, and InFocus LiteShow4.  Crestron AM-100 firmware 1.6.0.2 –  —

TIMELINE
  Jan 3   Reserved by tenable
  Apr 30  Published (CNA: tenable)
  Apr 15  Added to CISA KEV, remediation due 2022-05-06

CWE-79 · CNA: tenable · CVSS v3.1 · 5 references · KEV due May 6, 2022

Description

The Crestron AM-100 firmware 1.6.0.2, Crestron AM-101 firmware 2.7.0.1, Barco wePresent WiPG-1000P firmware 2.3.0.10, Barco wePresent WiPG-1600W before firmware 2.4.1.19, Extron ShareLink 200/250 firmware 2.0.3.4, Teq AV IT WIPS710 firmware 1.1.0.7, SHARP PN-L703WA firmware 1.4.2.3, Optoma WPS-Pro firmware 1.0.0.5, Blackbox HD WPS firmware 1.0.0.5, InFocus LiteShow3 firmware 1.0.16, and InFocus LiteShow4 2.0.0.7 are vulnerable to command injection via the file_transfer.cgi HTTP endpoint. A remote, unauthenticated attacker can use this vulnerability to execute operating system commands as root.

Lifecycle

Complete event history — 3 events, chronological
Date	Event	Detail
January 3, 2019	Reserved	Reserved by tenable
April 30, 2019	Published	Published (CNA: tenable)
April 15, 2022	KEV ADDED	Added to CISA KEV, remediation due 2022-05-06

Affected

Affected products and packages — 1 row
Vendor	Product / Package	Ecosystem	Version introduced	Fixed
Crestron	Crestron AirMedia, Barco WePresent, Extron ShareLink, Teq AV IT WIPS710, SHARP PN-L703WA, Optoma WPS-Pro, Blackbox HD WPS, InFocus LiteShow3, and InFocus LiteShow4.	—	Crestron AM-100 firmware 1.6.0.2	—

Weaknesses

CWE-79

References (5)

http://packetstormsecurity.com/files/152715/Barco-AWIND-OEM-Presentation-Platform-Unauthenticated-Remote-Command-Injection.html [x_refsource_MISC]
http://packetstormsecurity.com/files/155948/Barco-WePresent-file_transfer.cgi-Command-Injection.html [x_refsource_MISC]
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-3929 [government-resource]
https://www.exploit-db.com/exploits/46786/ [exploit, x_refsource_EXPLOIT-DB]
https://www.tenable.com/security/research/tra-2019-20 [x_refsource_MISC]

Authoritative record: CVE-2019-3929 at cve.org

Vendors: crestron

Weaknesses: CWE-79

About this page

This is a reference page, not a dated page of record. It assembles the complete lifecycle of CVE-2019-3929 from the CVE Program record, NVD enrichment, the CISA KEV catalog, EPSS, and OSV advisories. The box score's numbers (CVSS, EPSS, KEV status) are current as of Wednesday, October 7, 2026 UTC and are re-derived as the archive grows; only dated daily editions are immutable pages of record. The authoritative source for this identifier is cve.org.