Description
Crestron TSW-X60 all versions prior to 2.001.0037.001 and MC3 all versions prior to 1.502.0047.00, The passwords for special sudo accounts may be calculated using information accessible to those with regular user privileges. Attackers could decipher these passwords, which may allow them to execute hidden API calls and escape the CTP console sandbox environment with elevated privileges.
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
GitHub 2 repositories
-
axcheron/crestron_getsudopwd ★ 28 · Dec 13, 2019
Tool to exploit CVE-2018-13341 and recover hidden account password on Crestron devices
-
RajChowdhury240/CVE-2018-13341 ★ 0 · Apr 5, 2021
This Tool Aims to Exploit the CVE-2018-13341
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Advisories 1
- ICSA-18-221-01 Crestron TSW-X60 and MC3 CISA ICS & IT advisories · Aug 9, 2018