CVE-2023-38405

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.6% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2023-07-17 · updated 2026-06-17
Weakness: CWE-770

Description

On Crestron 3-Series Control Systems before 1.8001.0187, crafting and sending a specific BACnet packet can cause a crash.

Affected products

Crestron Cp3-Gv 6506034 Firmware: before 1.8001.0187 — fixed in 1.8001.0187
Crestron Cp3 6504877 Firmware: before 1.8001.0187 — fixed in 1.8001.0187
Crestron Cp3N 6505417 Firmware: before 1.8001.0187 — fixed in 1.8001.0187

How to fix

Upgrade to a fixed version: Crestron Cp3-Gv 6506034 Firmware 1.8001.0187; Crestron Cp3 6504877 Firmware 1.8001.0187; Crestron Cp3N 6505417 Firmware 1.8001.0187. Check the vendor advisory for mitigations.

References

https://www.crestron.com/release_notes/cp3n_1.8001.0187_release_notes.pdf
https://www.crestron.com/release_notes/cp3n_1.8001.0187_release_notes.pdf

Get alerted when CVE-2023-38405 or the next vulnerability affects your stack