PT-2018-11766 · Crestron · Crestron Tsw-X60+1

Jackson Thuraisamy + 1 · Publicado 2018-08-10 · Atualizado 2019-10-03 · CVE-2018-13341

Positive Technologies (AI Summary)

CVSS v3.1

8.8

Alta

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Crestron TSW-X60 versions prior to 2.001.0037.001 Crestron MC3 versions prior to 1.502.0047.00

Description The issue allows attackers to calculate passwords for special sudo accounts using information accessible to regular users. This could enable them to execute hidden API calls and escape the sandbox environment with elevated privileges.

Recommendations For Crestron TSW-X60 versions prior to 2.001.0037.001, update to version 2.001.0037.001 or later. For Crestron MC3 versions prior to 1.502.0047.00, update to version 1.502.0047.00 or later.

Exploit

Correção

Identificadores relacionados

CVE-2018-13341

ZDI-18-920

Produtos afetados

Crestron Mc3

Crestron Tsw-X60

Referências · 6

• 🔥 https://github.com/axcheron/crestron_getsudopwd · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2018-13341 · Nota de Segurança
• https://zerodayinitiative.com/advisories/ZDI-18-920 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2018-13341 · Aviso do Fabricante
• https://ics-cert.us-cert.gov/advisories/ICSA-18-221-01 · Nota
• http://securityfocus.com/bid/105051 · Nota