Description
Crestron DMC-STRO 1.0 devices allow remote command execution as root via shell metacharacters to the ping function.
Affected products
crestron: dmc-stro firmware; crestron: dmc-stro
References8
- www.quantumleap.it/crestron-dmc-stro-remote-root-rce/ ExploitThird Party Advisory
- www.quantumleap.it/crestron-dmc-stro-remote-root-rce/ ExploitThird Party Advisory
- cyberleap.it/advisories/cve-2019-18184
- web.archive.org/web/20201221031912/www.quantumleap.it/crestron-…
- www.crestron.com/en-US/Products/Video/DigitalMedia-Modular-Matr… Product
- www.quantumleap.it/news/advisory/ Third Party Advisory
- www.crestron.com/en-US/Products/Video/DigitalMedia-Modular-Matr… Product
- www.quantumleap.it/news/advisory/ Third Party Advisory
Metrics
- CVSS 3.1
-
9.8
CRITICAL
Score source: NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - EPSS — exploit probability
- 8% percentile: 95 · as of 10 November 2026
- CWE
- CWE-78
Could this be exploited in your environment?
A patch closes the known hole. A penetration test shows what an attacker can still reach — with proof.