CVE-2017-16710

Severity: medium (CVSS 4.8 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.6% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2018-07-11 · updated 2026-06-17
Weakness: CWE-79

Description

Cross-site scripting (XSS) vulnerability in Crestron Airmedia AM-100 devices with firmware before 1.6.0 and AM-101 devices with firmware before 2.7.0 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

Affected products

Crestron AM-100 Before 1.6.0.2: before 1.6.0 — fixed in 1.6.0
Crestron Airmedia Am-101 Firmware: before 2.7.0 — fixed in 2.7.0

How to fix

Upgrade to a fixed version: Crestron AM-100 Before 1.6.0.2 1.6.0; Crestron Airmedia Am-101 Firmware 2.7.0. Check the vendor advisory for mitigations.

References

https://support.crestron.com/app/answers/answer_view/a_id/5471/~/the-latest-details-from-crestron-on-security-and-safety-on-the-internet#CVE-2017-16710
https://support.crestron.com/app/answers/answer_view/a_id/5471/~/the-latest-details-from-crestron-on-security-and-safety-on-the-internet#CVE-2017-16710

Get alerted when CVE-2017-16710 or the next vulnerability affects your stack