# Discovering Vulnerabilities in Enterprise Audiovisual Hardware

Unauthenticated command injection in Aver PTC320UV2 camera /action?Get= endpoint and Crestron TSW-1060 HDCP2XLOAD console command yield root RCE.

- Payout: Research
- Severity: critical
- Program: Aver PTC320UV2
- Write-up by: Eugene Lim
- Disclosed: 2026-05-01
- CVE: CVE-2026-26461
- Write-up quality: 8/10
- Original: https://spaceraccoon.dev/discovering-vulnerabilities-enterprise-audiovisual-hardware/
- Library page: https://bugbountylibrary.com/r/blog%3Aspaceraccoon-dev-discovering-vulnerabilities-enterprise-audiovisual-hardware
- Tags: area:devices domain:iot impact:data-leak impact:rce kind:research platform:research sev:critical tech:linux technique:reverse-engineering technique:source-review vuln:auth-bypass vuln:command-injection vuln:rce vuln:secrets-leak

**Target:** cgi-bin web API (/action) and Crestron Terminal Protocol console (a_console binary)
**Root cause:** Aver cgi-bin passes the Get= query value unsanitized into snprintf then system_ctrl() shell execution; Crestron HDCP2XLOAD -c handler passes user input into popenCmd() with @ske_upgrade@ prefix.
**Steps:**
1. Aver: send `GET /action?Get=acc;ls;` to camera web interface, no auth required
2. Observe command executes as root via system_ctrl FIFO dispatch
3. Crestron: connect to Crestron Terminal Protocol on port 41795/telnet/SSH
4. Run `HDCP2XLOAD -c;whoami;` at TSW-1060> prompt
5. Observe `root` output from popenCmd
6. Chain: hold three fingers on Gingco app, enter hardcoded password `gingco`, set WebView URL to `file:///data/crestron/passwd` to leak admin hashes
7. Crack DES crypt hashes (fixed salt `cr`, 7-byte chunks) with `hashcat -m 1500`
8. Use recovered admin creds to reach console, then HDCP2XLOAD injection for root
**How found:** Read cgi-bin binary routes and found /action?Get= strncmp then snprintf into system_ctrl. For Crestron, analyzed a_console binary; HELP output was incomplete, so enumerated handler functions by their help-string pattern; used Claude Code with Ghidra scripts, which initially missed strings in .data.rel.ro until corrected with HDCP2XLOAD example.
**Exploitation:** Aver: single unauthenticated HTTP GET yields root shell; internet-exposed instances found via Shodan. Crestron: unauthenticated console access (before user config) or leaked admin creds via Gingco WebView file:// disclosure, then HDCP2XLOAD -c injection for root; root enables network pivot, persistence, camera/mic surveillance.
**Escalation:** Crestron chain escalates unauthenticated file disclosure (hardcoded Gingco password + unsandboxed WebView) to admin hash leak, cracked via weak DES, then console command injection to root.
**Insight:** Vendor HELP/auto-complete listings omit hidden console commands; enumerate handler functions by their help-string code pattern in the binary rather than trusting HELP output. When using LLM+Ghidra, strings may live in .data.rel.ro not .rodata, causing missed commands.