PT-2018-10746 · Lutron · Lutron Radiora 2

Publicado 2018-06-02 · Atualizado 2024-08-05 · CVE-2018-11681

Positive Technologies (AI Summary)

CVSS v2.0

10

Crítica

Vetor base

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Lutron RadioRA 2 versions Revision M through Revision Y

Description The issue allows attackers to gain total super user control of an IoT device through a TELNET session. Default and unremovable support credentials are used, with the username nwk and password nwk2. The vendor disputes this as a vulnerability, stating that the accessible commands are limited to controlling lighting and do not allow arbitrary code execution or admin-level control of a machine.

Recommendations For versions Revision M through Revision Y, consider disabling the TELNET session as a temporary workaround to minimize the risk of exploitation. Restrict access to the default support credentials to prevent unauthorized control of the IoT device.

Correção

Using Hardcoded Credentials

Enumeração de Fraquezas

CWE-798

Identificadores relacionados

CVE-2018-11681

Produtos afetados

Lutron Radiora 2

Referências · 5

• https://reversecodes.wordpress.com/2018/06/02/0-day-tomando-el-control-de-las-instalaciones-de-la-nasa-en-cabo-canaveral · Nota
• http://lutron.com/TechnicalDocumentLibrary/040249.pdf · Nota
• http://sadfud.me/explotos/CVE-2018-11629 · Nota
• https://t.me/cvenotify/89134 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2018-11681 · Nota de Segurança