CVE-2023-6926 is a high severity (CVSS 8.4) OS command injection in Crestron AM-300 firmware 1.4499.00018. A user of a limited-access SSH session could escalate to root. Crestron resolved it in firmware 1.4499.00023.001 or higher, so update the device firmware. Limit SSH access in the meantime.
What's affected
The CISA advisory ICSA-24-023-02 lists the Crestron AirMedia Presentation System AM-300, firmware version 1.4499.00018, as affected. Crestron resolved the issue in firmware 1.4499.00023.001 or higher, per CISA. The CVSS score in the advisory is 8.4, matching the record.
The weakness needs access to a limited SSH session first, so the biggest exposure is on networks where several people or systems can log in to meeting-room devices.
How to check if you're exposed
Check the firmware version in the device's web interface or through your Crestron management tooling, and compare it with 1.4499.00023.001.
Also inventory every AM-300 on your network. Meeting room gear is often installed by facilities or AV teams and missed by IT asset lists.
What to do now
- Update AM-300 firmware to 1.4499.00023.001 or higher, following Crestron's security guidance.
- Restrict SSH on meeting room devices to a management network.
- Change default and shared credentials on these devices.
- Add AV equipment to your asset inventory and patch cycle.
Why it matters
OS command injection happens when a program builds a shell command from input without neutralizing special characters. Here, a user in a limited SSH session can supply input that ends up running as root. The record tags CWE-78.
Local privilege escalation flaws matter most on shared or multi-user systems, and on machines where a low-privilege account already exists for a service. The attacker needs a foothold first, but a foothold plus a root-level flaw is how small incidents become full compromises. Embedded and AV devices often run old Linux builds with a root-level service behind a restricted login, which is exactly the setup this flaw exploits.
Firmware and engineering software update slowly. Start with an inventory of what you run and where it connects. Network isolation buys time while you test and schedule updates, and it is usually the first measure vendors recommend. Give each exception an owner and a review date so the workaround does not become permanent.
Weakness class in the record: CWE-78 (OS Command Injection).
Quick check
Do we need SSH enabled on these devices?
If not, turn it off or limit it to a management network. Removing the service removes the path.
What if we cannot patch quickly?
Reduce who and what can reach the device. Segment the network, restrict management access to a known host, and record the exception with an owner and a review date.
Sources
Last reviewed: 19 October 2026.
