What’s Vulnerable › Vulnerabilities
CVE-2020-16839
- Severity: high (CVSS 7.5 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 1.2% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2021-07-30 · updated 2026-06-17
- Weakness: CWE-287
Description
On Crestron DM-NVX-DIR, DM-NVX-DIR80, and DM-NVX-ENT devices before the DM-XIO/1-0-3-802 patch, the password can be changed by sending an unauthenticated WebSocket request.
Affected products
- Crestron Dm-Nvx-Dir-160 Firmware: 1.0.1.788
- Crestron Dm-Nvx-Dir-80 Firmware: 1.0.1.788
- Crestron Dm-Nvx-Dir-Ent Firmware: 1.0.1.788
References
- https://support.crestron.com
- https://www.crestron.com/Software-Firmware/Firmware/DigitalMedia/DM-XIO/1-0-3-802
- https://www.security.crestron.com
- https://www.crestron.com/Security/Security-at-Crestron
- https://support.crestron.com
- https://www.crestron.com/Software-Firmware/Firmware/DigitalMedia/DM-XIO/1-0-3-802
- https://www.security.crestron.com
Get alerted when CVE-2020-16839 or the next vulnerability affects your stack