CVEvulnerability

CVE-2018-13341

8.8 HIGH Published 2018-08-10 Modified 2026-06-17 Official page ↗

Status: Modified
Published: 2018-08-10
Last modified: 2026-06-17
Assigner: [email protected]
CVSS 3.0 ([email protected]): 8.8 HIGH — CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0 ([email protected]): 4.0 MEDIUM — AV:N/AC:L/Au:S/C:P/I:N/A:N

Description

Crestron TSW-X60 all versions prior to 2.001.0037.001 and MC3 all versions prior to 1.502.0047.00, The passwords for special sudo accounts may be calculated using information accessible to those with regular user privileges. Attackers could decipher these passwords, which may allow them to execute hidden API calls and escape the CTP console sandbox environment with elevated privileges.

Affected configurations

• crestron tsw-x60 firmware (< 2.001.0037.001) • crestron mc3 firmware (< 1.502.0047.00)

References

http://www.securityfocus.com/bid/105051 Third Party Advisory, VDB Entry
https://ics-cert.us-cert.gov/advisories/ICSA-18-221-01 Mitigation, Third Party Advisory, US Government Resource
http://www.securityfocus.com/bid/105051 Third Party Advisory, VDB Entry
https://ics-cert.us-cert.gov/advisories/ICSA-18-221-01 Mitigation, Third Party Advisory, US Government Resource