PT-2018-10016 · Crestron · Crestron Tsw-X60+1

Publicado 2018-08-10 · Atualizado 2019-10-09 · CVE-2018-10630

Positive Technologies (AI Summary)

CVSS v2.0

10

Crítica

Vetor base

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Crestron TSW-X60 versions prior to 2.001.0037.001 Crestron MC3 versions prior to 1.502.0047.001

Description The devices are shipped with authentication disabled, and there is no indication to users that they need to take steps to enable it. When compromised, the access to the CTP console is left open.

Recommendations For Crestron TSW-X60 versions prior to 2.001.0037.001, enable authentication to secure the device. For Crestron MC3 versions prior to 1.502.0047.001, enable authentication to secure the device. As a temporary workaround, consider restricting access to the CTP console until authentication is enabled.

Correção

Improper Access Control

Improper Authentication

Enumeração de Fraquezas

CWE-284

CWE-287

Identificadores relacionados

CVE-2018-10630

ZDI-18-932

Produtos afetados

Crestron Mc3

Crestron Tsw-X60

Referências · 5

• https://zerodayinitiative.com/advisories/ZDI-18-932 · Nota de Segurança
• https://nvd.nist.gov/vuln/detail/CVE-2018-10630 · Nota de Segurança
• http://securityfocus.com/bid/105051 · Nota
• https://ics-cert.us-cert.gov/advisories/ICSA-18-221-01 · Correção
• https://osv.dev/vulnerability/CVE-2018-10630 · Aviso do Fabricante