High severity · published Aug 10, 2018
CVE-2018-13341
Crestron TSW-X60 all versions prior to 2.001.0037.001 and MC3 all versions prior to 1.502.0047.00, The passwords for special sudo accounts may be calculated using information…
8.8
CVSS
3.7%
EPSS
No
On KEV
Description
Crestron TSW-X60 all versions prior to 2.001.0037.001 and MC3 all versions prior to 1.502.0047.00, The passwords for special sudo accounts may be calculated using information accessible to those with regular user privileges. Attackers could decipher these passwords, which may allow them to execute hidden API calls and escape the CTP console sandbox environment with elevated privileges.
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)3.7% · higher than 90% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
MF
Mc3 Firmware · Crestron
before 1.502.0047.00 · source: NVD
TF
Tsw-x60 Firmware · Crestron
before 2.001.0037.001 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2018-13341
CVE.org
https://www.cve.org/CVERecord?id=CVE-2018-13341
Third Party Advisory
http://www.securityfocus.com/bid/105051
Mitigation
https://ics-cert.us-cert.gov/advisories/ICSA-18-221-01
More from Mc3 Firmware
9.8
CVE-2018-10630
For Crestron TSW-X60 version prior to 2.001.0037.001 and MC3 version prior to 1.502.0047.001, The devices are shipped with authentication disabled, and there is no indication to…