CVE-2018-13341

Crestron TSW-X60 all versions prior to 2.001.0037.001 and MC3 all versions prior to 1.502.0047.00, The passwords for special sudo accounts may be calculated using information accessible to those with regular user privileges. Attackers could decipher these passwords, which may allow them to execute hidden API calls and escape the CTP console sandbox environment with elevated privileges.

• http://www.securityfocus.com/bid/105051Third Party Advisory, VDB Entry
• https://ics-cert.us-cert.gov/advisories/ICSA-18-221-01Mitigation, Third Party Advisory, US Government Resource
• http://www.securityfocus.com/bid/105051Third Party Advisory, VDB Entry
• https://ics-cert.us-cert.gov/advisories/ICSA-18-221-01Mitigation, Third Party Advisory, US Government Resource

Published

Aug 10, 2018

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2018-13336System command injection in ajaxdata.php in TerraMaster TOS …
• CVE-2018-13337Session Fixation in the web application for TerraMaster TOS …
• CVE-2018-13338System command injection in ajaxdata.php in TerraMaster TOS …
• CVE-2018-13339Imperavi Redactor 3 in Angular Redactor 1.1.6, when HTML con…
• CVE-2018-1334In Apache Spark 1.0.0 to 2.1.2, 2.2.0 to 2.2.1, and 2.3.0, w…
• CVE-2018-13340Gleez CMS 1.2.0 has CSRF, as demonstrated by a /page/add req…
• CVE-2018-13342The server API in the Anda app relies on hardcoded credentia…
• CVE-2018-13346The mpatch_apply function in mpatch.c in Mercurial before 4.…
• CVE-2018-13347mpatch.c in Mercurial before 4.6.1 mishandles integer additi…
• CVE-2018-13348The mpatch_decode function in mpatch.c in Mercurial before 4…
• CVE-2018-13349Cross-site scripting in the web application taskbar in Terra…
• CVE-2018-1335From Apache Tika versions 1.7 to 1.17, clients could send ca…