CVE-2019-18184

CriticalCVSS 9.8/10Last modified Aug 7, 2026

Description

Crestron DMC-STRO 1.0 devices allow remote command execution as root via shell metacharacters to the ping function.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-78

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://cyberleap.it/advisories/cve-2019-18184
https://web.archive.org/web/20201221031912/https://www.quantumleap.it/crestron-dmc-stro-remote-root-rce/
https://www.crestron.com/en-US/Products/Video/DigitalMedia-Modular-Matrix/Output-Cards-Blades/DMC-STROProduct
https://www.quantumleap.it/crestron-dmc-stro-remote-root-rce/Exploit, Third Party Advisory
https://www.quantumleap.it/news/advisory/Third Party Advisory
https://www.crestron.com/en-US/Products/Video/DigitalMedia-Modular-Matrix/Output-Cards-Blades/DMC-STROProduct
https://www.quantumleap.it/crestron-dmc-stro-remote-root-rce/Exploit, Third Party Advisory
https://www.quantumleap.it/news/advisory/Third Party Advisory

Timeline

Published: Nov 27, 2019
Last modified: Aug 7, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-181877.5Trend Micro OfficeScan versions 11.0 and XG (12.0) could be exploited by an attacker utilizing a directory traversal vulnerability to extrac CVE-2019-181887.5Trend Micro Apex One could be exploited by an attacker utilizing a command injection vulnerability to extract files from an arbitrary zip fi CVE-2019-181899.8A directory traversal vulnerability in Trend Micro Apex One, OfficeScan (11.0, XG) and Worry-Free Business Security (9.5, 10.0) may allow an CVE-2019-18196.5A vulnerability in the web-based management interface of Cisco Prime Infrastructure and Cisco Evolved Programmable Network (EPN) Manager sof CVE-2019-181909.8Trend Micro Security (Consumer) 2020 (v16.x) is affected by a vulnerability in where null pointer dereference errors result in the crash of CVE-2019-181918.8A privilege escalation vulnerability in the Trend Micro Deep Security as a Service Quick Setup cloud formation template could allow an authe CVE-2019-181927.8GNU Guix 1.0.1 allows local users to gain access to an arbitrary user's account because the parent directory of the user-profile directories CVE-2019-181937.5In Unisys Stealth (core) 3.4.108.0, 3.4.209.x, 4.0.027.x and 4.0.114, key material inadvertently logged under certain conditions. Fixed incl CVE-2019-181947.8TotalAV 2020 4.14.31 has a quarantine flaw that allows privilege escalation. Exploitation uses an NTFS directory junction to restore a malic CVE-2019-181958.8An issue was discovered on TerraMaster FS-210 4.0.19 devices. Normal users can use 1.user.php for privilege elevation.CVE-2019-181966.7A DLL side loading vulnerability in the Windows Service in TeamViewer versions up to 11.0.133222 (fixed in 11.0.214397), 12.0.181268 (fixed CVE-2019-181977.5In xsltCopyText in transform.c in libxslt 1.1.33, a pointer variable isn't reset under certain circumstances. If the relevant memory area ha