github - ghsa-cpgg-gfx5-33r2

GHSA-CPGG-GFX5-33R2

Vulnerability from github – Published: 2025-05-06 21:30 – Updated: 2025-05-06 21:30

Details

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Crestron Automate VX allows Functionality Misuse.

There is no visible indication when the system is recording and recording can be enabled remotely via a network API. This issue affects Automate VX: from 5.6.8161.21536 through 6.4.0.49.

Severity ?

5.3 (Medium)


                  
                    CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2025-47418"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-200"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-05-06T21:16:20Z",
    "severity": "MODERATE"
  },
  "details": "Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Crestron Automate VX allows Functionality Misuse.\n\nThere is no visible indication when the system is recording and recording can be enabled remotely via a network API. \nThis issue affects Automate VX: from 5.6.8161.21536 through 6.4.0.49.",
  "id": "GHSA-cpgg-gfx5-33r2",
  "modified": "2025-05-06T21:30:49Z",
  "published": "2025-05-06T21:30:49Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-47418"
    },
    {
      "type": "WEB",
      "url": "https://security.crestron.com"
    },
    {
      "type": "WEB",
      "url": "https://www.crestron.com/Software-Firmware/Software/Automate-VX-Software/6-4-1-8"
    },
    {
      "type": "WEB",
      "url": "https://www.crestron.com/release_notes/automate_vx_6.4.1.8_release_notes.pdf"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}

CVE-2025-47418 (GCVE-0-2025-47418)

Vulnerability from cvelistv5 – Published: 2025-05-06 20:13 – Updated: 2025-05-07 14:04

Title

Recording

Summary

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Crestron Automate VX allows Functionality Misuse. There is no visible indication when the system is recording and recording can be enabled remotely via a network API. This issue affects Automate VX: from 5.6.8161.21536 through 6.4.0.49.

Severity ?

5.3 (Medium)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

CWE

CWE-200 - Exposure of Sensitive Information to an Unauthorized Actor

Assigner

Crestron

References

URL

Tags

	https://security.crestron.com/	vendor-advisory
	https://www.crestron.com/Software-Firmware/Softwa…
	https://www.crestron.com/release_notes/automate_v…	release-notes

Impacted products

	Vendor	Product	Version
	Crestron	Automate VX	Affected: 5.6.8161.21536 , ≤ 6.4.0.49 (custom)

Credits

Crestron Electronics Inc

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-47418",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-05-07T13:46:13.710646Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-05-07T14:04:11.178Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Automate VX",
          "vendor": "Crestron",
          "versions": [
            {
              "changes": [
                {
                  "at": "6.4.1.8",
                  "status": "unaffected"
                }
              ],
              "lessThanOrEqual": "6.4.0.49",
              "status": "affected",
              "version": "5.6.8161.21536",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Crestron Electronics Inc"
        }
      ],
      "datePublic": "2025-04-23T20:04:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Crestron Automate VX allows Functionality Misuse.\u003cbr\u003e\u003cbr\u003eThere is no visible indication when the system is recording and recording can be enabled remotely via a network API. \u003cbr\u003e\u003cp\u003eThis issue affects Automate VX: from 5.6.8161.21536 through 6.4.0.49.\u003c/p\u003e"
            }
          ],
          "value": "Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Crestron Automate VX allows Functionality Misuse.\n\nThere is no visible indication when the system is recording and recording can be enabled remotely via a network API. \nThis issue affects Automate VX: from 5.6.8161.21536 through 6.4.0.49."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-212",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-212 Functionality Misuse"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "LOW",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "LOW",
            "vulnIntegrityImpact": "NONE",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-200",
              "description": "CWE-200 Exposure of Sensitive Information to an Unauthorized Actor",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-05-06T20:20:24.812Z",
        "orgId": "25b0b659-c4b4-483f-aecb-067757d23ef3",
        "shortName": "Crestron"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://security.crestron.com/"
        },
        {
          "url": "https://www.crestron.com/Software-Firmware/Software/Automate-VX-Software/6-4-1-8"
        },
        {
          "tags": [
            "release-notes"
          ],
          "url": "https://www.crestron.com/release_notes/automate_vx_6.4.1.8_release_notes.pdf"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eCrestron recommends updating to firmware version 6.4.1.8 or higher. The firmware version will\u0026nbsp;\u003c/span\u003e\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eadds \u003c/span\u003e\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003ea\u003c/span\u003e\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003e visual\u003c/span\u003e \u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eindication\u003c/span\u003e \u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eon \u003c/span\u003e\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003ethe program \u003c/span\u003e\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003evideo output \u003c/span\u003e\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003ewhen recording is \u003c/span\u003e\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003estarted\u003c/span\u003e\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003e.\u003c/span\u003e\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003e\u0026nbsp;\u0026nbsp;\u003c/span\u003e\u003cbr\u003e"
            }
          ],
          "value": "Crestron recommends updating to firmware version 6.4.1.8 or higher. The firmware version will\u00a0adds a visual indication on the program video output when recording is started."
        }
      ],
      "source": {
        "discovery": "INTERNAL"
      },
      "title": "Recording",
      "workarounds": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eInform users in the room that they may be recorded. Also, configure the network to only allow needed systems and/or devices to access the API.\u003c/span\u003e\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003e\u0026nbsp;\u003c/span\u003e\n\n\u003cbr\u003e"
            }
          ],
          "value": "Inform users in the room that they may be recorded. Also, configure the network to only allow needed systems and/or devices to access the API."
        }
      ],
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "25b0b659-c4b4-483f-aecb-067757d23ef3",
    "assignerShortName": "Crestron",
    "cveId": "CVE-2025-47418",
    "datePublished": "2025-05-06T20:13:38.805Z",
    "dateReserved": "2025-05-06T19:36:18.441Z",
    "dateUpdated": "2025-05-07T14:04:11.178Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

GHSA-CPGG-GFX5-33R2

CVE-2025-47418 (GCVE-0-2025-47418)

Tags

Sightings

Nomenclature