CVE-2018-11629 Hardcoded credentials in n/a
Hardcoded credentials allow attackers to gain super user control over Lutron HomeWorks QS devices via Telnet, despite vendor disputes regarding code execution.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2018-11629?
CVE-2018-11629 is a critical vulnerability in n/a, published on 2 Jun 2018. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Default and unremovable support credentials (user:lutron password:integration) allow attackers to gain total super user control of an IoT device through a TELNET session to products using the HomeWorks QS Lutron integration protocol Revision M to Revision Y. NOTE: The vendor disputes this id as not being a vulnerability because what can be done through the ports revolve around controlling lighting, not code execution. A certain set of commands are listed, which bear some similarity to code, but they are not arbitrary and do not allow admin-level control of a machine
Weakness: CWE-798
Which versions are affected by CVE-2018-11629?
It affects 3 products.
Products include Lutron Homeworks Qs Firmware, Lutron Radiora 2 Firmware, Lutron Stanza Firmware.
How do I fix CVE-2018-11629?
No fix has been published for CVE-2018-11629 yet. Limit exposure of the affected software until one is available.
Is CVE-2018-11629 being exploited?
There is no known exploitation of CVE-2018-11629 in the wild and no public exploit code.
Other vulnerabilities in n/a
Sources
Also known as GHSA-gr9f-5gfg-6vvv.