A hidden console command in certain Crestron Touchpanels can be abused to inject operating‑system commands. The vulnerability is caused by improper handling of control characters passed to a popen call, which falls under CWE‑88. Successful exploitation allows an attacker to run arbitrary shell commands with the privileges of the console process, potentially leading to full system compromise and the compromise of connected facilities.

Crestron Electronics Touchpanels series x60 and x70 are affected by this flaw. The issue arises in the console command functionality of these devices and is documented in the vendor’s firmware release notes for the relevant models.

The vulnerability carries a CVSS score of 7.4, indicating high severity. An EPSS score is not available, and the flaw is not listed in the CISA KEV catalog. The likely attack vector requires an attacker to have authenticated SSH access to the device’s console; without such credentials the command injection cannot be performed.