CVE-2019-3910: Crestron Airmedia AM-100 Firmware

Critical severity, CVSS 9.1. EPSS: 8.6% chance of exploitation in the next 30 days.

Crestron AM-100 before firmware version 1.6.0.2 contains an authentication bypass in the web interface's return.cgi script. Unauthenticated remote users can use the bypass to access some administrator functionality such as configuring update sources and rebooting the device.

Affected products

• Crestron Airmedia AM-100 Firmware: before 1.6.0.2 (fixed in 1.6.0.2)

Published 2019-01-18. Last modified 2026-06-17.