A hidden console command is vulnerable to command injection flaw when control characters are passed to its second argument.

Code

The project this record applies to. Exploit listings stay in References.

No public source repository is identified for this product.

Timeline

Detection, updates, and resolution for this record.

1. May 5, 2026 · NIST NVD

   Detected

   A hidden console command is vulnerable to command injection flaw when control characters are passed to its second argument. A third party researcher Eugene Lim had discovered vulnerability in the way console command passes to a popen function call. Attackers with authenticated access to SSH console of Crestron devices may use to run underlying OS commands.

2. Jul 24, 2026 · NIST NVD

   Updated

   A hidden console command is vulnerable to command injection flaw when control characters are passed to its second argument. A third party researcher Eugene Lim had discovered vulnerability in the way console command passes to a popen function call. Attackers with authenticated access to SSH console of Crestron devices may use to run underlying OS commands.

Sources

• CVE.orgVulnerability recordCVE-2026-7865

  Official CVE identifier

  cve.org
• NIST NVDVulnerability recordCVE-2026-7865

  A hidden console command is vulnerable to command injection flaw when control characters are passed to its second argument. A third party researcher Eugene Lim had discovered vulnerability in the way console command passes to a popen function call. Attackers with authenticated

  nvd.nist.gov

References

• Reference · crestron.com
• Reference · crestron.com