What’s Vulnerable › Vulnerabilities

CVE-2025-47421: Privilege escalation via SCP login

• Severity: high (CVSS 8.6 v4.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2025-09-03 · updated 2026-06-17
• Weakness: CWE-88

Description

Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') vulnerability in CRESTRON TOUCHSCREENS x70 allows Argument Injection.This issue affects TOUCHSCREENS x70: from 3.001.0031.001 through 3.001.0034.001. A specially crafted SCP command sent via SSH login string can lead a valid administrator user to gain Privileged Operating System access on the device. Following Products Models are affected: TSW-x70 TSW-x60 TST-1080 AM-3000/3100/3200 Soundbar VB70 HD-PS622/621/402 HD-TXU-RXU-4kZ-211 HD-MDNXM-4KZ-E *Note: additional firmware updates will be published once made available

Affected products

• CRESTRON TOUCHSCREENS x70: from 3.001.0031.001 before 3.001.0034.001 — fixed in 3.001.0034.001

How to fix

Upgrade to a fixed version: CRESTRON TOUCHSCREENS x70 3.001.0034.001. Check the vendor advisory for mitigations.

References

• https://https://www.crestron.com/Software-Firmware/Firmware/Touchpanels/TS-770-TS-1070-TSS-770-TSS-1070-TSW-570/3-002-0040-001
• https://https://www.crestron.com/release_notes/tsw-xx70_3.002.0040.001_release_notes.pdf
• https://security.crestron.com

Get alerted when CVE-2025-47421 or the next vulnerability affects your stack