Critical severity · published Aug 10, 2018
CVE-2018-10630
For Crestron TSW-X60 version prior to 2.001.0037.001 and MC3 version prior to 1.502.0047.001, The devices are shipped with authentication disabled, and there is no indication to…
9.8
CVSS
10.5%
EPSS
No
On KEV
Description
For Crestron TSW-X60 version prior to 2.001.0037.001 and MC3 version prior to 1.502.0047.001, The devices are shipped with authentication disabled, and there is no indication to users that they need to take steps to enable it. When compromised, the access to the CTP console is left open.
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)10.5% · higher than 96% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CT
Crestron TSW-X60 version prior to 2.001.0037.001 and MC3 version prior to 1.502.0047.001 · ICS-CERT
Crestron TSW-X60 version prior to 2.001.0037.001 and MC3 version prior to 1.502.0047.001 · source: vendor
MF
Mc3 Firmware · Crestron
before 1.502.0047.001 · source: NVD
TF
Tsw-x60 Firmware · Crestron
before 2.001.0037.001 · source: NVD
Affected product
CT
Crestron TSW-X60 version prior to 2.001.0037.001 and MC3 version prior to 1.502.0047.001
ICS-CERT