PT-2018-10714 · Lutron · Homeworks Qs

Published 2018-06-02 · Updated 2024-08-05 · CVE-2018-11629

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions HomeWorks QS Lutron integration protocol versions Revision M through Revision Y

Description The issue allows attackers to gain total super user control of an IoT device through a TELNET session. Default and unremovable support credentials are used, with the username being lutron and the password being integration. The vendor disputes this as a vulnerability, stating that the accessible commands are limited to controlling lighting and do not allow arbitrary code execution or admin-level control of a machine.

Recommendations For HomeWorks QS Lutron integration protocol versions Revision M through Revision Y, consider disabling the TELNET session as a temporary workaround to minimize the risk of exploitation. Restrict access to the default support credentials to prevent unauthorized control of the IoT device. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Using Hardcoded Credentials

Weakness Enumeration

CWE-798

Related Identifiers

CVE-2018-11629

Affected Products

Homeworks Qs

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2018-11629 · Security Note
• http://lutron.com/TechnicalDocumentLibrary/040249.pdf · Note
• https://t.me/cvenotify/89135 · Telegram Post
• https://t.me/cvenotify/89134 · Telegram Post
• https://t.me/cvenotify/89133 · Telegram Post
• https://reversecodes.wordpress.com/2018/06/02/0-day-tomando-el-control-de-las-instalaciones-de-la-nasa-en-cabo-canaveral · Note
• http://sadfud.me/explotos/CVE-2018-11629 · Note
• https://t.me/cvenotify/82622 · Telegram Post