CVE-2019-3929

Name: CVE-2019-3929
Creator: NVD / NIST
Published: 2019-04-30T21:29:00.713+00:00
License: https://creativecommons.org/publicdomain/zero/1.0/

CRITICALCVSS 9.8/10Actively ExploitedEPSS 98.95%

Last modified Jun 17, 2026

CVE-2019-3929 is a critical-severity vulnerability rated 9.8/10 on the CVSS scale. The Crestron AM-100 firmware 1.6.0.2, Crestron AM-101 firmware 2.7.0.1, Barco wePresent WiPG-1000P firmware 2.3.0.10, Barco wePresent WiPG-1600W before firmware 2.4.1.19, Extron ShareLink 200/250 firmware 2.0.3.4, Teq AV IT WIPS710 firmware 1.1.0.7, SHARP PN-L703WA firmware 1.4.2.3, Optoma WPS-Pro firmware 1.0.0.5, Blackbox HD WPS firmware 1.0.0.5, InFocus LiteShow3 firmware 1.0.16, and InFocus LiteShow4 2.0.0.7 are vulnerable to command injection via the file_transfer.cgi HTTP endpoint. A remote, unauthenticated attacker can use this vulnerability to execute operating system commands as root.. CISA has confirmed active exploitation in the wild. EPSS estimates a 98.95% chance of exploitation in the next 30 days.

Description

The Crestron AM-100 firmware 1.6.0.2, Crestron AM-101 firmware 2.7.0.1, Barco wePresent WiPG-1000P firmware 2.3.0.10, Barco wePresent WiPG-1600W before firmware 2.4.1.19, Extron ShareLink 200/250 firmware 2.0.3.4, Teq AV IT WIPS710 firmware 1.1.0.7, SHARP PN-L703WA firmware 1.4.2.3, Optoma WPS-Pro firmware 1.0.0.5, Blackbox HD WPS firmware 1.0.0.5, InFocus LiteShow3 firmware 1.0.16, and InFocus LiteShow4 2.0.0.7 are vulnerable to command injection via the file_transfer.cgi HTTP endpoint. A remote, unauthenticated attacker can use this vulnerability to execute operating system commands as root.

Metrics

CVSS 3.1

9.8/10

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS Probability

98.95%

99.9th percentile

Probability of exploitation in the next 30 days. Learn more

Exploitation Status

This vulnerability is listed in CISA’s Known Exploited Vulnerabilities catalog, confirming active exploitation in the wild. Federal agencies must remediate by May 6, 2022.

Weakness Enumeration

Affected Software

Vendor	Product	Versions
Crestron	Am-100 Firmware	1.6.0.2
Crestron	Am-101 Firmware	2.7.0.2
Barco	Wepresent Wipg-1000p Firmware	2.3.0.10
Barco	Wepresent Wipg-1600w Firmware	< 2.4.1.19
Extron	Sharelink 200 Firmware	2.0.3.4
Extron	Sharelink 250 Firmware	2.0.3.4
Teqavit	Wips710 Firmware	1.1.0.7
Sharp	Pn-L703wa Firmware	1.4.2.3
Optoma	Wps-Pro Firmware	1.0.0.5
Blackbox	Hd Wireless Presentation System Firmware	1.0.0.5
Infocus	Liteshow3 Firmware	1.0.16
Infocus	Liteshow4 Firmware	2.0.0.7

References

http://packetstormsecurity.com/files/152715/Barco-AWIND-OEM-Presentation-Platform-Unauthenticated-Remote-Command-Injection.htmlThird Party Advisory, VDB Entry
http://packetstormsecurity.com/files/155948/Barco-WePresent-file_transfer.cgi-Command-Injection.htmlThird Party Advisory, VDB Entry
https://www.exploit-db.com/exploits/46786/Exploit, Third Party Advisory, VDB Entry
https://www.tenable.com/security/research/tra-2019-20Exploit, Third Party Advisory
http://packetstormsecurity.com/files/152715/Barco-AWIND-OEM-Presentation-Platform-Unauthenticated-Remote-Command-Injection.htmlThird Party Advisory, VDB Entry
http://packetstormsecurity.com/files/155948/Barco-WePresent-file_transfer.cgi-Command-Injection.htmlThird Party Advisory, VDB Entry
https://www.exploit-db.com/exploits/46786/Exploit, Third Party Advisory, VDB Entry
https://www.tenable.com/security/research/tra-2019-20Exploit, Third Party Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-3929US Government Resource

Timeline

Published: Apr 30, 2019
Last Modified: Jun 17, 2026
Status: Analyzed

Frequently Asked Questions

What is CVE-2019-3929?

How severe is CVE-2019-3929?

CVE-2019-3929 has a CVSS score of 9.8/10 (CRITICAL severity). The EPSS model estimates a 98.95% probability of exploitation in the next 30 days. This vulnerability is listed in CISA's Known Exploited Vulnerabilities catalog.

How do I fix CVE-2019-3929?

Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

Are you affected by CVE-2019-3929?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST