CVE-2018-10630

Опубликовано: 10 авг. 2018

Источник: nvd

CVSS3: 9.8

CVSS2: 10

EPSS Низкий

Описание

For Crestron TSW-X60 version prior to 2.001.0037.001 and MC3 version prior to 1.502.0047.001, The devices are shipped with authentication disabled, and there is no indication to users that they need to take steps to enable it. When compromised, the access to the CTP console is left open.

Ссылки

http://www.securityfocus.com/bid/105051
Third Party Advisory
VDB Entry
https://ics-cert.us-cert.gov/advisories/ICSA-18-221-01
Patch
Third Party Advisory
US Government Resource
http://www.securityfocus.com/bid/105051
Third Party Advisory
VDB Entry
https://ics-cert.us-cert.gov/advisories/ICSA-18-221-01
Patch
Third Party Advisory
US Government Resource

Уязвимые конфигурации

Конфигурация 1

Одновременно

cpe:2.3:o:crestron:tsw-x60_firmware:*:*:*:*:*:*:*:*

Версия до 2.001.0037.001 (исключая)

Одно из

cpe:2.3:h:crestron:tsw-1060-b-s:-:*:*:*:*:*:*:*

cpe:2.3:h:crestron:tsw-1060-nc-b-s:-:*:*:*:*:*:*:*

cpe:2.3:h:crestron:tsw-1060-nc-w-s:-:*:*:*:*:*:*:*

cpe:2.3:h:crestron:tsw-1060-w-s:-:*:*:*:*:*:*:*

cpe:2.3:h:crestron:tsw-560-b-s:-:*:*:*:*:*:*:*

cpe:2.3:h:crestron:tsw-560-nc-b-s:-:*:*:*:*:*:*:*

cpe:2.3:h:crestron:tsw-560-nc-w-s:-:*:*:*:*:*:*:*

cpe:2.3:h:crestron:tsw-560-w-s:-:*:*:*:*:*:*:*

cpe:2.3:h:crestron:tsw-760-b-s:-:*:*:*:*:*:*:*

cpe:2.3:h:crestron:tsw-760-nc-b-s:-:*:*:*:*:*:*:*

cpe:2.3:h:crestron:tsw-760-nc-w-s:-:*:*:*:*:*:*:*

cpe:2.3:h:crestron:tsw-760-w-s:-:*:*:*:*:*:*:*

Конфигурация 2

Одновременно

cpe:2.3:o:crestron:mc3_firmware:*:*:*:*:*:*:*:*

Версия до 1.502.0047.001 (исключая)

cpe:2.3:h:crestron:mc3:-:*:*:*:*:*:*:*

EPSS

Процентиль: 51%

0.00282

Низкий

9.8 Critical

CVSS3

10 Critical

CVSS2

Дефекты

CWE-284

CWE-287

Связанные уязвимости

GHSA-cwc8-6j25-gg7r