Vulnerabilites related to crestron - tsw-560-nc-w-s
Vulnerability from fkie_nvd
Published
2018-08-10 19:29
Modified
2024-11-21 03:46
Severity ?
8.8 (High) - CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Summary
Crestron TSW-X60 all versions prior to 2.001.0037.001 and MC3 all versions prior to 1.502.0047.00, The passwords for special sudo accounts may be calculated using information accessible to those with regular user privileges. Attackers could decipher these passwords, which may allow them to execute hidden API calls and escape the CTP console sandbox environment with elevated privileges.
References
cve@mitre.orghttp://www.securityfocus.com/bid/105051Third Party Advisory, VDB Entry
cve@mitre.orghttps://ics-cert.us-cert.gov/advisories/ICSA-18-221-01Mitigation, Third Party Advisory, US Government Resource
af854a3a-2127-422b-91ae-364da2661108http://www.securityfocus.com/bid/105051Third Party Advisory, VDB Entry
af854a3a-2127-422b-91ae-364da2661108https://ics-cert.us-cert.gov/advisories/ICSA-18-221-01Mitigation, Third Party Advisory, US Government Resource
Impacted products
Vendor Product Version
crestron tsw-x60_firmware *
crestron tsw-1060-b-s -
crestron tsw-1060-nc-b-s -
crestron tsw-1060-nc-w-s -
crestron tsw-1060-w-s -
crestron tsw-560-b-s -
crestron tsw-560-nc-b-s -
crestron tsw-560-nc-w-s -
crestron tsw-560-w-s -
crestron tsw-760-b-s -
crestron tsw-760-nc-b-s -
crestron tsw-760-nc-w-s -
crestron tsw-760-w-s -
crestron mc3_firmware *
crestron mc3 -


To clipboard 

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:crestron:tsw-x60_firmware:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "B0C26C6C-4F6D-4084-AA36-CDBBF5B182F0",
              "versionEndExcluding": "2.001.0037.001",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:crestron:tsw-1060-b-s:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "5B827C62-5712-4511-8506-74B925DA053B",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:crestron:tsw-1060-nc-b-s:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "D41EF7B1-8F7A-4F66-B9B1-90405F507FE8",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:crestron:tsw-1060-nc-w-s:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "28A41D87-44CE-452D-A696-5DFCAEFF3D4C",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:crestron:tsw-1060-w-s:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "BCAC6D4C-51C5-4687-B9F5-8B3FD9F4503E",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:crestron:tsw-560-b-s:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "A7B4BBE9-C4D1-42C1-AD23-3F47D2E7BCD4",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:crestron:tsw-560-nc-b-s:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "621667FD-7FC9-4606-857B-2423EAEF613A",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:crestron:tsw-560-nc-w-s:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "30C58417-CA62-4E68-8421-A968406F4797",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:crestron:tsw-560-w-s:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "5A888FB2-6F71-4D45-9E03-505DAD49909A",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:crestron:tsw-760-b-s:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "01970CD6-3FE7-42BF-A2BB-358692F8B787",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:crestron:tsw-760-nc-b-s:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "507A0431-6EB0-4535-AD17-97C09542AB6E",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:crestron:tsw-760-nc-w-s:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "B084CEC7-E1B0-44F1-AAAB-CEC86EA767AF",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:crestron:tsw-760-w-s:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "5FBE392B-4A2B-4B7E-9F1D-6E55FCE0146C",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:crestron:mc3_firmware:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "A80A1FEE-30EF-43E2-8AE9-895E18F4DDB1",
              "versionEndExcluding": "1.502.0047.00",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:crestron:mc3:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "3E648452-F573-478D-9A32-1D76534926D4",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Crestron TSW-X60 all versions prior to 2.001.0037.001 and MC3 all versions prior to 1.502.0047.00, The passwords for special sudo accounts may be calculated using information accessible to those with regular user privileges. Attackers could decipher these passwords, which may allow them to execute hidden API calls and escape the CTP console sandbox environment with elevated privileges."
    },
    {
      "lang": "es",
      "value": "Para las versiones anteriores a la 2.001.0037.001 de Crestron TSW-X60 y las versiones anteriores a la 1.502.0047.001 de MC3, las contrase\u00f1as para las cuentas sudo especiales podr\u00edan calcularse mediante informaci\u00f3n accesible a aquellos que tengan privilegios de usuario regular. Los atacantes podr\u00edan descifrar estas contrase\u00f1as, lo que les permitir\u00eda ejecutar llamadas ocultas a la API y escapar del entorno de la consola CTP con privilegios elevados."
    }
  ],
  "id": "CVE-2018-13341",
  "lastModified": "2024-11-21T03:46:55.450",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "MEDIUM",
        "cvssData": {
          "accessComplexity": "LOW",
          "accessVector": "NETWORK",
          "authentication": "SINGLE",
          "availabilityImpact": "NONE",
          "baseScore": 4.0,
          "confidentialityImpact": "PARTIAL",
          "integrityImpact": "NONE",
          "vectorString": "AV:N/AC:L/Au:S/C:P/I:N/A:N",
          "version": "2.0"
        },
        "exploitabilityScore": 8.0,
        "impactScore": 2.9,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV30": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 8.8,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "version": "3.0"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 5.9,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ]
  },
  "published": "2018-08-10T19:29:00.380",
  "references": [
    {
      "source": "cve@mitre.org",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "url": "http://www.securityfocus.com/bid/105051"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Mitigation",
        "Third Party Advisory",
        "US Government Resource"
      ],
      "url": "https://ics-cert.us-cert.gov/advisories/ICSA-18-221-01"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "url": "http://www.securityfocus.com/bid/105051"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Mitigation",
        "Third Party Advisory",
        "US Government Resource"
      ],
      "url": "https://ics-cert.us-cert.gov/advisories/ICSA-18-221-01"
    }
  ],
  "sourceIdentifier": "cve@mitre.org",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "NVD-CWE-noinfo"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}

Vulnerability from fkie_nvd
Published
2018-08-10 19:29
Modified
2024-11-21 03:41
Severity ?
9.8 (Critical) - CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Summary
For Crestron TSW-X60 version prior to 2.001.0037.001 and MC3 version prior to 1.502.0047.001, The devices are shipped with authentication disabled, and there is no indication to users that they need to take steps to enable it. When compromised, the access to the CTP console is left open.
References
ics-cert@hq.dhs.govhttp://www.securityfocus.com/bid/105051Third Party Advisory, VDB Entry
ics-cert@hq.dhs.govhttps://ics-cert.us-cert.gov/advisories/ICSA-18-221-01Patch, Third Party Advisory, US Government Resource
af854a3a-2127-422b-91ae-364da2661108http://www.securityfocus.com/bid/105051Third Party Advisory, VDB Entry
af854a3a-2127-422b-91ae-364da2661108https://ics-cert.us-cert.gov/advisories/ICSA-18-221-01Patch, Third Party Advisory, US Government Resource
Impacted products
Vendor Product Version
crestron tsw-x60_firmware *
crestron tsw-1060-b-s -
crestron tsw-1060-nc-b-s -
crestron tsw-1060-nc-w-s -
crestron tsw-1060-w-s -
crestron tsw-560-b-s -
crestron tsw-560-nc-b-s -
crestron tsw-560-nc-w-s -
crestron tsw-560-w-s -
crestron tsw-760-b-s -
crestron tsw-760-nc-b-s -
crestron tsw-760-nc-w-s -
crestron tsw-760-w-s -
crestron mc3_firmware *
crestron mc3 -


To clipboard 

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:crestron:tsw-x60_firmware:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "B0C26C6C-4F6D-4084-AA36-CDBBF5B182F0",
              "versionEndExcluding": "2.001.0037.001",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:crestron:tsw-1060-b-s:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "5B827C62-5712-4511-8506-74B925DA053B",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:crestron:tsw-1060-nc-b-s:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "D41EF7B1-8F7A-4F66-B9B1-90405F507FE8",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:crestron:tsw-1060-nc-w-s:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "28A41D87-44CE-452D-A696-5DFCAEFF3D4C",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:crestron:tsw-1060-w-s:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "BCAC6D4C-51C5-4687-B9F5-8B3FD9F4503E",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:crestron:tsw-560-b-s:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "A7B4BBE9-C4D1-42C1-AD23-3F47D2E7BCD4",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:crestron:tsw-560-nc-b-s:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "621667FD-7FC9-4606-857B-2423EAEF613A",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:crestron:tsw-560-nc-w-s:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "30C58417-CA62-4E68-8421-A968406F4797",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:crestron:tsw-560-w-s:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "5A888FB2-6F71-4D45-9E03-505DAD49909A",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:crestron:tsw-760-b-s:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "01970CD6-3FE7-42BF-A2BB-358692F8B787",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:crestron:tsw-760-nc-b-s:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "507A0431-6EB0-4535-AD17-97C09542AB6E",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:crestron:tsw-760-nc-w-s:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "B084CEC7-E1B0-44F1-AAAB-CEC86EA767AF",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:crestron:tsw-760-w-s:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "5FBE392B-4A2B-4B7E-9F1D-6E55FCE0146C",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:crestron:mc3_firmware:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "B16FD3DA-6249-4252-A76A-E3BDDD37E849",
              "versionEndExcluding": "1.502.0047.001",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:crestron:mc3:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "3E648452-F573-478D-9A32-1D76534926D4",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "For Crestron TSW-X60 version prior to 2.001.0037.001 and MC3 version prior to 1.502.0047.001, The devices are shipped with authentication disabled, and there is no indication to users that they need to take steps to enable it. When compromised, the access to the CTP console is left open."
    },
    {
      "lang": "es",
      "value": "Para las versiones anteriores a la 2.001.0037.001 de Crestron TSW-X60 y las versiones anteriores a la 1.502.0047.001 de MC3, los dispositivos se distribuyen con la autenticaci\u00f3n deshabilitada y no existen indicaciones de que los usuarios deban tomar medidas para habilitada. Al estar comprometidos, el acceso a la consola CTP se deja abierto."
    }
  ],
  "id": "CVE-2018-10630",
  "lastModified": "2024-11-21T03:41:41.853",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": true,
        "baseSeverity": "HIGH",
        "cvssData": {
          "accessComplexity": "LOW",
          "accessVector": "NETWORK",
          "authentication": "NONE",
          "availabilityImpact": "COMPLETE",
          "baseScore": 10.0,
          "confidentialityImpact": "COMPLETE",
          "integrityImpact": "COMPLETE",
          "vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
          "version": "2.0"
        },
        "exploitabilityScore": 10.0,
        "impactScore": 10.0,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV30": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 9.8,
          "baseSeverity": "CRITICAL",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "version": "3.0"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 5.9,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ]
  },
  "published": "2018-08-10T19:29:00.240",
  "references": [
    {
      "source": "ics-cert@hq.dhs.gov",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "url": "http://www.securityfocus.com/bid/105051"
    },
    {
      "source": "ics-cert@hq.dhs.gov",
      "tags": [
        "Patch",
        "Third Party Advisory",
        "US Government Resource"
      ],
      "url": "https://ics-cert.us-cert.gov/advisories/ICSA-18-221-01"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "url": "http://www.securityfocus.com/bid/105051"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Patch",
        "Third Party Advisory",
        "US Government Resource"
      ],
      "url": "https://ics-cert.us-cert.gov/advisories/ICSA-18-221-01"
    }
  ],
  "sourceIdentifier": "ics-cert@hq.dhs.gov",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-284"
        }
      ],
      "source": "ics-cert@hq.dhs.gov",
      "type": "Secondary"
    },
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-287"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}

cve-2018-13341
Vulnerability from cvelistv5
Published
2018-08-10 19:00
Modified
2024-09-16 18:44
Severity ?
Summary
Crestron TSW-X60 all versions prior to 2.001.0037.001 and MC3 all versions prior to 1.502.0047.00, The passwords for special sudo accounts may be calculated using information accessible to those with regular user privileges. Attackers could decipher these passwords, which may allow them to execute hidden API calls and escape the CTP console sandbox environment with elevated privileges.
References
http://www.securityfocus.com/bid/105051vdb-entry, x_refsource_BID
https://ics-cert.us-cert.gov/advisories/ICSA-18-221-01x_refsource_MISC
Impacted products
Vendor Product Version
n/a n/a Version: n/a
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T09:00:34.951Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "105051",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/105051"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://ics-cert.us-cert.gov/advisories/ICSA-18-221-01"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2018-08-09T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "Crestron TSW-X60 all versions prior to 2.001.0037.001 and MC3 all versions prior to 1.502.0047.00, The passwords for special sudo accounts may be calculated using information accessible to those with regular user privileges. Attackers could decipher these passwords, which may allow them to execute hidden API calls and escape the CTP console sandbox environment with elevated privileges."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2018-08-14T09:57:01",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "name": "105051",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/105051"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://ics-cert.us-cert.gov/advisories/ICSA-18-221-01"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "DATE_PUBLIC": "2018-08-09T00:00:00",
          "ID": "CVE-2018-13341",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Crestron TSW-X60 all versions prior to 2.001.0037.001 and MC3 all versions prior to 1.502.0047.00, The passwords for special sudo accounts may be calculated using information accessible to those with regular user privileges. Attackers could decipher these passwords, which may allow them to execute hidden API calls and escape the CTP console sandbox environment with elevated privileges."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "105051",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/105051"
            },
            {
              "name": "https://ics-cert.us-cert.gov/advisories/ICSA-18-221-01",
              "refsource": "MISC",
              "url": "https://ics-cert.us-cert.gov/advisories/ICSA-18-221-01"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2018-13341",
    "datePublished": "2018-08-10T19:00:00Z",
    "dateReserved": "2018-07-05T00:00:00",
    "dateUpdated": "2024-09-16T18:44:09.884Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

cve-2018-10630
Vulnerability from cvelistv5
Published
2018-08-10 19:00
Modified
2024-09-16 16:52
Severity ?
Summary
For Crestron TSW-X60 version prior to 2.001.0037.001 and MC3 version prior to 1.502.0047.001, The devices are shipped with authentication disabled, and there is no indication to users that they need to take steps to enable it. When compromised, the access to the CTP console is left open.
References
http://www.securityfocus.com/bid/105051vdb-entry, x_refsource_BID
https://ics-cert.us-cert.gov/advisories/ICSA-18-221-01x_refsource_MISC
Impacted products
Vendor Product Version
ICS-CERT Crestron TSW-X60 version prior to 2.001.0037.001 and MC3 version prior to 1.502.0047.001 Version: Crestron TSW-X60 version prior to 2.001.0037.001 and MC3 version prior to 1.502.0047.001
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T07:46:46.245Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "105051",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/105051"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://ics-cert.us-cert.gov/advisories/ICSA-18-221-01"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Crestron TSW-X60 version prior to 2.001.0037.001 and MC3 version prior to 1.502.0047.001",
          "vendor": "ICS-CERT",
          "versions": [
            {
              "status": "affected",
              "version": "Crestron TSW-X60 version prior to 2.001.0037.001 and MC3 version prior to 1.502.0047.001"
            }
          ]
        }
      ],
      "datePublic": "2018-08-09T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "For Crestron TSW-X60 version prior to 2.001.0037.001 and MC3 version prior to 1.502.0047.001, The devices are shipped with authentication disabled, and there is no indication to users that they need to take steps to enable it. When compromised, the access to the CTP console is left open."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-284",
              "description": "Improper Access Control CWE-284",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2018-08-14T09:57:01",
        "orgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
        "shortName": "icscert"
      },
      "references": [
        {
          "name": "105051",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/105051"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://ics-cert.us-cert.gov/advisories/ICSA-18-221-01"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "ics-cert@hq.dhs.gov",
          "DATE_PUBLIC": "2018-08-09T00:00:00",
          "ID": "CVE-2018-10630",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Crestron TSW-X60 version prior to 2.001.0037.001 and MC3 version prior to 1.502.0047.001",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "Crestron TSW-X60 version prior to 2.001.0037.001 and MC3 version prior to 1.502.0047.001"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "ICS-CERT"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "For Crestron TSW-X60 version prior to 2.001.0037.001 and MC3 version prior to 1.502.0047.001, The devices are shipped with authentication disabled, and there is no indication to users that they need to take steps to enable it. When compromised, the access to the CTP console is left open."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "Improper Access Control CWE-284"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "105051",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/105051"
            },
            {
              "name": "https://ics-cert.us-cert.gov/advisories/ICSA-18-221-01",
              "refsource": "MISC",
              "url": "https://ics-cert.us-cert.gov/advisories/ICSA-18-221-01"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
    "assignerShortName": "icscert",
    "cveId": "CVE-2018-10630",
    "datePublished": "2018-08-10T19:00:00Z",
    "dateReserved": "2018-05-01T00:00:00",
    "dateUpdated": "2024-09-16T16:52:46.583Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}