CVE-2018-8880

Published: Apr 23, 2018Modified: Jun 17, 2026

7.5

Vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Exploitability: 3.9 / Impact: 3.6

Source: NVD

Description

Lutron Quantum BACnet Integration 2.0 (firmware 3.2.243) doesn't check for correct user authentication before showing the /deviceIP information, which leads to internal network information disclosure.

Affected (1)

Products: Lutron: Quantum Bacnet Integration Firmware

Lutron

1 product

Quantum Bacnet Integration Firmware

Configuration A

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Lutron Quantum Bacnet Integration Firmware	Version 3.2.243

Running on/with	Platform Versions
Lutron Quantum Bacnet Integration	Version 2.0

Related CWEs

CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

References (4)

http://sadfud.me/explotos/deviceip.txt

Source: cve@mitre.org

ExploitThird Party Advisory

https://www.exploit-db.com/exploits/44488/

Source: cve@mitre.org

ExploitThird Party AdvisoryVDB Entry

http://sadfud.me/explotos/deviceip.txt

Source: af854a3a-2127-422b-91ae-364da2661108

ExploitThird Party Advisory

https://www.exploit-db.com/exploits/44488/

Source: af854a3a-2127-422b-91ae-364da2661108

ExploitThird Party AdvisoryVDB Entry

Timeline

No history available yet.