#VU14301 Command injection in Crestron Electronics products - CVE-2018-11229
Published: August 10, 2018
Vulnerability identifier: #VU14301
Vulnerability risk: Low
CVSSv4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear
CVE-ID: CVE-2018-11229
CWE-ID: CWE-77
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerable software:
TSW-560-NC
TSW-760-NC
TSW-1060-NC
TSW-560
TSW-760
TSW-1060
TSW-560-NC
TSW-760-NC
TSW-1060-NC
TSW-560
TSW-760
TSW-1060
Software vendor:
Crestron Electronics
Crestron Electronics
Description
The vulnerability allows a remote attacker to execute arbitrary commands on the target system.
The vulnerability exists due to command injection in Crestron Toolbox Protocol (CTP). A remote unauthenticated attacker can submit a specially crafted input and execute arbitrary code with elevated privileges.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
Remediation
Update the affected software to version 2.001.0037.001.