CVE-2018-10630
9.8
CRITICAL · CVSS 3.0 · EPSS 10.9% (pctl 96)
Patch early
EPSS 10.9% — above the 10% action threshold.
Description
For Crestron TSW-X60 version prior to 2.001.0037.001 and MC3 version prior to 1.502.0047.001, The devices are shipped with authentication disabled, and there is no indication to users that they need to take steps to enable it. When compromised, the access to the CTP console is left open.
Scoring
| CVSS | 9.8 (CRITICAL, v3.0) |
|---|---|
| Vector | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| EPSS | 10.91% — more likely to be exploited than 96% of all CVEs |
| Weakness | CWE-284 |
| On CISA KEV | no |
| Public exploit | none known |
| Published | 2018-08-10 |
| Last modified | 2026-06-17 |
Affected (15)
| Vendor | Product |
|---|---|
| crestron | mc3 |
| crestron | mc3 firmware |
| crestron | tsw-1060-b-s |
| crestron | tsw-1060-nc-b-s |
| crestron | tsw-1060-nc-w-s |
| crestron | tsw-1060-w-s |
| crestron | tsw-560-b-s |
| crestron | tsw-560-nc-b-s |
| crestron | tsw-560-nc-w-s |
| crestron | tsw-560-w-s |
| crestron | tsw-760-b-s |
| crestron | tsw-760-nc-b-s |
| crestron | tsw-760-nc-w-s |
| crestron | tsw-760-w-s |
| crestron | tsw-x60 firmware |
References
→ the Explorer · watch your stack · NVD