CVE-2025-47421
Unknown Unknown - Not Provided
BaseFortify

Publication date: 2025-09-03

Last updated on: 2025-09-04

Assigner: Crestron Electronics, Inc.

Description
Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') vulnerability in CRESTRON TOUCHSCREENS x70 allows Argument Injection.This issue affects TOUCHSCREENS x70: from 3.001.0031.001 through 3.001.0034.001. A specially crafted SCP command sent via SSH login string can lead a valid administrator user to gain Privileged Operating System access on the device. Following Products Models are affected: TSW-x70 TSW-x60 TST-1080 AM-3000/3100/3200 Soundbar VB70 HD-PS622/621/402 HD-TXU-RXU-4kZ-211 HD-MDNXM-4KZ-E *Note: additional firmware updates will be published once made available
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2025-09-03
Last Modified
2025-09-04
Generated
2026-06-16
AI Q&A
2025-09-03
EPSS Evaluated
2026-06-15
NVD
CVE-2025-47421
EUVD
EUVD-2025-26506
Affected Vendors & Products
Showing 12 associated CPEs
Vendor Product Version / Range
crestron soundbar_vb70 *
crestron tst_1080 *
crestron hd_ps622 *
crestron hd_ps621 *
crestron hd_txu_rxu_4kz_211 *
crestron touchscreens_x70 3.001.0034.001
crestron am_3000 *
crestron tsw_x60 *
crestron tsw_x70 *
crestron touchscreens_x70 3.001.0031.001
crestron hd_ps402 *
crestron hd_mdnxm_4kz_e *
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-88 The product constructs a string for a command to be executed by a separate component in another control sphere, but it does not properly delimit the intended arguments, options, or switches within that command string.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

This vulnerability is an Argument Injection issue in CRESTRON TOUCHSCREENS x70 devices. It occurs due to improper neutralization of argument delimiters in commands, allowing a specially crafted SCP command sent via SSH login string to enable a valid administrator user to gain privileged operating system access on the device.

Impact Analysis

An attacker who is a valid administrator can exploit this vulnerability to gain privileged operating system access on the affected device. This elevated access can allow the attacker to execute unauthorized commands, potentially compromising the device's security and control.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2025-47421. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart