Medium severity · published May 6, 2025
CVE-2025-47418
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Crestron Automate VX allows Functionality Misuse
5.3
CVSS
0.4%
EPSS
No
On KEV
Description
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Crestron Automate VX allows Functionality Misuse.
There is no visible indication when the system is recording and recording can be enabled remotely via a network API.
This issue affects Automate VX: from 5.6.8161.21536 through 6.4.0.49.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 37% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AV
Automate VX · Crestron
5.6.8161.21536 through 6.4.0.49 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-47418
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-47418
security.crestron.com
https://security.crestron.com/
www.crestron.com
https://www.crestron.com/Software-Firmware/Software/Automate-VX-Software/6-4-1-8
www.crestron.com
https://www.crestron.com/release_notes/automate_vx_6.4.1.8_release_notes.pdf
More from Automate VX
10.0
CVE-2025-47419
Non-Secure Access
8.7
CVE-2025-47420
User Permissions on Network API
5.1
CVE-2025-47417
Enable Debug Images