CVE-2025-47421CWE-88

Privilege escalation via SCP login

High · published September 3, 2025

CVSS v4.0
8.6
EPSS
0%
Percentile
29.4
In the wild
Unconfirmed
What it is

Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') vulnerability in CRESTRON TOUCHSCREENS x70 allows Argument Injection.This issue affects TOUCHSCREENS x70: from 3.001.0031.001 through 3.001.0034.001.

A specially crafted SCP command sent via SSH login string can lead a valid administrator user to gain Privileged Operating System access on the device.

Following Products Models are affected:

TSW-x70

TSW-x60

TST-1080

AM-3000/3100/3200

Soundbar VB70

HD-PS622/621/402

HD-TXU-RXU-4kZ-211

HD-MDNXM-4KZ-E

*Note: additional firmware updates will be published once made available

The record
Technical detail
CVSS v4.0
8.6 · HIGH
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS
0.00367 · 29.4th percentile
Weakness
CWE-88 · Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')
Published
2025-09-03T13:49Z
EPSS history
Timeline
  • 03 SEP 13:49Z
    Privilege escalation via SCP login
    cvelistv5