The product manual for the Crestron DGE-100 describes a “Crestron console” service listening on TCP port 41795, which requires “a proprietary management tool” to use. It is being disclosed in accordance Rapid7's vulnerability disclosure policy. This issue was discovered by Rapid7 researchers Cale Black and Jordan Larose. Crestron Electronics distributes this device globally. The typical installation is a corporate meeting space or control room. More information about the device is available at the vendor's website.

The Crestron Digital Graphics Engine 100 (DGE-100), is a hardware controller used to connect a touchscreen interface (commonly, a Crestron TSD-2220 HD touchscreen display) to external sources over HDMI, USB, or Ethernet. Users should update their DGE-100 devices to the latest firmware version available here. DGE-100 devices running firmware versions 1.3384.00049.001 and lower with default configuration are vulnerable to CVE-2018-5553.ĬVE-2018-5553 is categorized as CWE-78 (Improper Neutralization of Special Elements used in an OS Command), and has a base CVSSv3 score of 9.8 (Critical).

Due to a lack of input sanitization, this service is vulnerable to command injection that can be used to gain root-level access. TSR310 projects can be opened in XPanel but emulation isn't advised because it doesn't have an available faceplate for hard buttons & because the device definition handles Update Requests differently from most other panels.This post describes CVE-2018-5553, a vulnerability in the Crestron Console service that is preinstalled on the DGE-100. TSR302 requires you add the TSR302 XPanel 2.0 Simulator in SIMPL, and the XPanel has a Faceplate that can be enabled to emulate hard buttons on the remote when running a TSR302 project. However, they will revert to defaults when the c3p/vtz is recompiled. XPanel Connection Settings will default to what was set in the Project Level properties and changes made at runtime (from XPanel 'Options > Host Settings') will be retained when the program is closed/reopened. You'll need to 'File > Save Project As > XPANEL 2.0 Smart Graphics' to use the F11 Run As feature. That panel type in particular isn't currently compatible with the 'Run As' feature in VTProE. You should've mentioned you were trying to emulate Crestron App in your original post (found in comments below).

Crestron app xpanel