CVE-2018-11629
Description
Default and unremovable support credentials (user:lutron password:integration) allow attackers to gain total super user control of an IoT device through a TELNET session to products using the HomeWorks QS Lutron integration protocol Revision M to Revision Y. NOTE: The vendor disputes this id as not being a vulnerability because what can be done through the ports revolve around controlling lighting, not code execution. A certain set of commands are listed, which bear some similarity to code, but they are not arbitrary and do not allow admin-level control of a machine
How to fix
Sources list no fixed version or patch link for this vulnerability.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| lutron homeworks_qs_firmware | No range specified | — |
| lutron stanza_firmware | No range specified | — |
| lutron radiora_2_firmware | No range specified | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.