CVE-2018-11681 Hardcoded credentials in n/a
Hardcoded credentials allow attackers to gain super user control of Lutron RadioRA 2 devices via Telnet, enabling unauthorized lighting control.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2018-11681?
CVE-2018-11681 is a critical vulnerability in n/a, published on 2 Jun 2018. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Default and unremovable support credentials (user:nwk password:nwk2) allow attackers to gain total super user control of an IoT device through a TELNET session to products using the RadioRA 2 Lutron integration protocol Revision M to Revision Y. NOTE: The vendor disputes this id as not being a vulnerability because what can be done through the ports revolve around controlling lighting, not code execution. A certain set of commands are listed, which bear some similarity to code, but they are not arbitrary and do not allow admin-level control of a machine
Weakness: CWE-798
Which versions are affected by CVE-2018-11681?
It affects 3 products.
Products include Lutron Homeworks Qs Firmware, Lutron Radiora 2 Firmware, Lutron Stanza Firmware.
How do I fix CVE-2018-11681?
No fix has been published for CVE-2018-11681 yet. Limit exposure of the affected software until one is available.
Is CVE-2018-11681 being exploited?
There is no known exploitation of CVE-2018-11681 in the wild and no public exploit code.
Other vulnerabilities in n/a
Sources
Also known as GHSA-pgqh-j5f3-p3cf.