PT-2018-10747 · Lutron · Stanza Lutron Integration Protocol

Published 2018-06-02 · Updated 2024-08-05 · CVE-2018-11682

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Stanza Lutron integration protocol versions Revision M through Revision Y

Description The issue allows attackers to gain total super user control of an IoT device through a TELNET session. This is made possible by default and unremovable support credentials. The vendor disputes this issue, stating that the accessible commands are limited to controlling lighting and do not allow code execution or admin-level control of a machine.

Recommendations For versions Revision M through Revision Y, consider restricting access to the TELNET session as a temporary workaround until a more permanent solution is available. Additionally, limiting the use of support credentials can help minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this issue.

Fix

Using Hardcoded Credentials

Weakness Enumeration

CWE-798

Related Identifiers

CVE-2018-11682

Affected Products

Stanza Lutron Integration Protocol

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2018-11682 · Security Note
• https://reversecodes.wordpress.com/2018/06/02/0-day-tomando-el-control-de-las-instalaciones-de-la-nasa-en-cabo-canaveral · Note
• http://lutron.com/TechnicalDocumentLibrary/040249.pdf · Note
• http://sadfud.me/explotos/CVE-2018-11629 · Note
• https://t.me/cvenotify/89135 · Telegram Post
• https://t.me/cvenotify/82622 · Telegram Post