CVE-2018-10630
📋 TL;DR
Crestron TSW-X60 and MC3 devices ship with authentication disabled by default, leaving the CTP console unprotected. Attackers can gain unauthorized access to these industrial control systems without credentials. This affects users who haven't manually enabled authentication on affected versions.
💻 Affected Systems
- Crestron TSW-X60
- Crestron MC3
📦 What is this software?
Mc3 Firmware by Crestron
⚠️ Risk & Real-World Impact
Worst Case
Complete compromise of industrial control systems allowing attackers to manipulate building automation, security systems, or other critical infrastructure controlled by these devices.
Likely Case
Unauthorized access to device configuration and control interfaces, potentially enabling surveillance, data theft, or disruption of automated systems.
If Mitigated
Minimal impact if authentication is properly enabled and strong credentials are configured.
🎯 Exploit Status
Exploitation requires no authentication or special tools - simply accessing the unprotected console interface.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: TSW-X60: 2.001.0037.001 or later, MC3: 1.502.0047.001 or later
Vendor Advisory: https://ics-cert.us-cert.gov/advisories/ICSA-18-221-01
Restart Required: Yes
Instructions:
1. Download firmware update from Crestron support portal. 2. Apply update via device web interface or Crestron Toolbox. 3. Reboot device. 4. Enable authentication in device settings.
🔧 Temporary Workarounds
Enable Authentication
allManually enable authentication on affected devices immediately
Network Segmentation
allIsolate Crestron devices on separate VLAN with strict firewall rules
🧯 If You Can't Patch
- Immediately enable authentication in device settings
- Isolate devices from internet and restrict network access to trusted IPs only
🔍 How to Verify
Check if Vulnerable:
Check device web interface for authentication requirement when accessing CTP consoleCheck Version:
Check via device web interface or Crestron Toolbox softwareVerify Fix Applied:
Verify firmware version meets minimum requirements and authentication is required for console access📡 Detection & Monitoring
Log Indicators:
- Unauthenticated access attempts to CTP console
- Configuration changes without authentication logs
Network Indicators:
- Unusual traffic to Crestron device ports (typically 41794, 41795)
- Access from unauthorized IP addresses
SIEM Query:
source_ip=* AND dest_port IN (41794, 41795) AND NOT auth_success=true