Unauthenticated Command Injection in AWIND OEM Wireless Presentation Platforms

This repository contains a single Metasploit module (modules/exploits/linux/http/wepresent_cmd_injection.rb) that exploits an unauthenticated remote command injection vulnerability (CVE-2019-3929) in Barco WePresent and related OEM devices. The exploit targets the /cgi-bin/file_transfer.cgi HTTP(S) endpoint, sending a specially crafted POST request to inject and execute arbitrary commands on the device. The module supports both direct command execution and staged payload delivery (e.g., Meterpreter reverse shell) for ARM Linux targets. The exploit is weaponized, allowing for flexible payload selection and automated exploitation via the Metasploit framework. No authentication is required, and exploitation results in code execution as root. The code is written in Ruby and is structured as a standard Metasploit exploit module.

This repository contains a Metasploit module (CVE-2019-3929.rb) that exploits a remote command injection vulnerability (CVE-2019-3929) in multiple wireless presentation and collaboration devices from vendors such as Crestron, Barco, Extron, InFocus, Teq AV IT, SHARP, Optoma, and Blackbox. The exploit targets the /cgi-bin/file_transfer.cgi HTTP endpoint, allowing a remote, unauthenticated attacker to execute arbitrary operating system commands as root via crafted POST requests. The module supports multiple architectures (ARM, x86, x64, MIPS) and delivers a payload (default: Meterpreter reverse shell) using Metasploit's command stager. The README provides a summary of affected devices and credits Tenable for the discovery. The repository is structured as a typical Metasploit module with a single Ruby exploit file, a README, and a funding configuration file.