AV Control Processors Become A Hardening Target

The Q-SYS product security team published two advisories on 19 October that together describe the most serious class of problem in installed AV. The first scores 9.3 and covers an unauthenticated remote code execution flaw reachable through a web-accessible API endpoint, affecting Core processors and Cores running in Peripheral or I/O mode, the NC and NV series, the RMP-100 room processor and QIO-VEN4 desktop extender of the RoomSuite Modular System, TSC touchpanels, the I/O-USB-Bridge, the CX-Q, CXD-Q, DPA-Q, MPA-Q and SPA-Q amplifiers, DCIO and several QIO modules. The second scores 8.8 and covers an unauthenticated package installation path on peripherals. Both are resolved in Q-SYS Designer 10.4 and RoomSuite Modular System firmware 1.1.0, fixed on 29 September, with access control and password protection named as the interim mitigation. The researcher credited, Andrew Furlani, specialises in AV systems, and the vendor states it knows of no exploitation.

The lesson is not about one manufacturer. A modern control processor is a Linux or Android computer with a web server, a REST API, a firmware update channel and, increasingly, a cloud service broker. It lives on a flat corporate VLAN because that was the easiest way to let the touchpanel reach the room scheduler, and it is discovered by a building management scan that nobody reads. Attackers noticed. The mitigations in the advisory read like a template for every AV rack: enable authentication on the device itself, keep firmware on a supported branch with a named owner, do not publish management interfaces to the internet, and put control traffic on a segmented network that reaches only what it must.

The same month produced a quieter reminder about signage players. Microsoft's October cumulative update closed an exploited Windows shell flaw, and Windows 10 IoT Enterprise LTSB 2016 reached end of support on 13 October. Venues that bought fanless signage PCs around 2017 specifically because that build promised ten quiet years now own machines that will never receive another security fix, often sitting on the same network as the point-of-sale system or the box office. Since the flash memory itself is still in short supply across the industry, replacing an entire player fleet at once is unrealistic. The practical answer is triage: identify which players touch card data or personal data, move only those, isolate the rest on a guest VLAN, and stop using the reception desk computer as a signage source.

Amtune builds fixed-function hardware partly for this reason. A switcher, an extender or a matrix that exposes RS-232, IR and a documented web page, and nothing else, has a small attack surface by construction. Seamless hybrid matrices and AV switches carry no content store, no browser session and no cloud dependency, and HDBaseT extenders keep display traffic on copper rather than on a routable segment. Where a networked decoder is in the design, Amtune supplies the network plan alongside the hardware. Hardening notes and firmware policy at sales@amtune.com.