CVE-2018-13341

Опубликовано: 10 авг. 2018

Источник: nvd

CVSS3: 8.8

CVSS2: 4

EPSS Низкий

Описание

Crestron TSW-X60 all versions prior to 2.001.0037.001 and MC3 all versions prior to 1.502.0047.00, The passwords for special sudo accounts may be calculated using information accessible to those with regular user privileges. Attackers could decipher these passwords, which may allow them to execute hidden API calls and escape the CTP console sandbox environment with elevated privileges.

Ссылки

http://www.securityfocus.com/bid/105051
Third Party Advisory
VDB Entry
https://ics-cert.us-cert.gov/advisories/ICSA-18-221-01
Mitigation
Third Party Advisory
US Government Resource
http://www.securityfocus.com/bid/105051
Third Party Advisory
VDB Entry
https://ics-cert.us-cert.gov/advisories/ICSA-18-221-01
Mitigation
Third Party Advisory
US Government Resource

Уязвимые конфигурации

Конфигурация 1

Одновременно

cpe:2.3:o:crestron:tsw-x60_firmware:*:*:*:*:*:*:*:*

Версия до 2.001.0037.001 (исключая)

Одно из

cpe:2.3:h:crestron:tsw-1060-b-s:-:*:*:*:*:*:*:*

cpe:2.3:h:crestron:tsw-1060-nc-b-s:-:*:*:*:*:*:*:*

cpe:2.3:h:crestron:tsw-1060-nc-w-s:-:*:*:*:*:*:*:*

cpe:2.3:h:crestron:tsw-1060-w-s:-:*:*:*:*:*:*:*

cpe:2.3:h:crestron:tsw-560-b-s:-:*:*:*:*:*:*:*

cpe:2.3:h:crestron:tsw-560-nc-b-s:-:*:*:*:*:*:*:*

cpe:2.3:h:crestron:tsw-560-nc-w-s:-:*:*:*:*:*:*:*

cpe:2.3:h:crestron:tsw-560-w-s:-:*:*:*:*:*:*:*

cpe:2.3:h:crestron:tsw-760-b-s:-:*:*:*:*:*:*:*

cpe:2.3:h:crestron:tsw-760-nc-b-s:-:*:*:*:*:*:*:*

cpe:2.3:h:crestron:tsw-760-nc-w-s:-:*:*:*:*:*:*:*

cpe:2.3:h:crestron:tsw-760-w-s:-:*:*:*:*:*:*:*

Конфигурация 2

Одновременно

cpe:2.3:o:crestron:mc3_firmware:*:*:*:*:*:*:*:*

Версия до 1.502.0047.00 (исключая)

cpe:2.3:h:crestron:mc3:-:*:*:*:*:*:*:*

EPSS

Процентиль: 85%

0.02586

Низкий

8.8 High

CVSS3

4 Medium

CVSS2

Дефекты

NVD-CWE-noinfo

Связанные уязвимости

GHSA-h2g2-jr6r-r36p