Lutron

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2018-11682 1Lutron 3Homeworks Qs Firmware Radiora 2 FirmwareStanza Firmware Nov 21, 2024 Jun 2, 2018 N/A· v4 9.8 CRITICAL· v3 10.0 HIGH· v2 Default and unremovable support credentials allow attackers to gain total super user control of an IoT device through a TELNET session to products using the Stanza Lutron integration protocol Revision M to Revision Y. NO...Show more Default and unremovable support credentials allow attackers to gain total super user control of an IoT device through a TELNET session to products using the Stanza Lutron integration protocol Revision M to Revision Y. NOTE: The vendor disputes this id as not being a vulnerability because what can be done through the ports revolve around controlling lighting, not code execution. A certain set of commands are listed, which bear some similarity to code, but they are not arbitrary and do not allow admin-level control of a machineShow less
CVE-2018-11681 1Lutron 3Homeworks Qs Firmware Radiora 2 FirmwareStanza Firmware Nov 21, 2024 Jun 2, 2018 N/A· v4 9.8 CRITICAL· v3 10.0 HIGH· v2 Default and unremovable support credentials (user:nwk password:nwk2) allow attackers to gain total super user control of an IoT device through a TELNET session to products using the RadioRA 2 Lutron integration protocol...Show more Default and unremovable support credentials (user:nwk password:nwk2) allow attackers to gain total super user control of an IoT device through a TELNET session to products using the RadioRA 2 Lutron integration protocol Revision M to Revision Y. NOTE: The vendor disputes this id as not being a vulnerability because what can be done through the ports revolve around controlling lighting, not code execution. A certain set of commands are listed, which bear some similarity to code, but they are not arbitrary and do not allow admin-level control of a machineShow less
CVE-2018-11629 1Lutron 3Homeworks Qs Firmware Radiora 2 FirmwareStanza Firmware Nov 21, 2024 Jun 2, 2018 N/A· v4 9.8 CRITICAL· v3 10.0 HIGH· v2 Default and unremovable support credentials (user:lutron password:integration) allow attackers to gain total super user control of an IoT device through a TELNET session to products using the HomeWorks QS Lutron integrat...Show more Default and unremovable support credentials (user:lutron password:integration) allow attackers to gain total super user control of an IoT device through a TELNET session to products using the HomeWorks QS Lutron integration protocol Revision M to Revision Y. NOTE: The vendor disputes this id as not being a vulnerability because what can be done through the ports revolve around controlling lighting, not code execution. A certain set of commands are listed, which bear some similarity to code, but they are not arbitrary and do not allow admin-level control of a machineShow less
CVE-2018-8880 1Lutron 1Quantum Bacnet Integration Firmware Jun 17, 2026 Apr 23, 2018 N/A· v4 7.5 HIGH· v3 5.0 MEDIUM· v2 Lutron Quantum BACnet Integration 2.0 (firmware 3.2.243) doesn't check for correct user authentication before showing the /deviceIP information, which leads to internal network information disclosure.
CVE-2018-7276 1Lutron 1Quantum Bacnet Integration Firmware Jun 17, 2026 Feb 21, 2018 N/A· v4 7.5 HIGH· v3 5.0 MEDIUM· v2 An issue was discovered on Lutron Quantum BACnet Integration 2.0 (firmware 3.2.243) devices. Remote attackers can obtain potentially sensitive information via a /DbXmlInfo.xml request, as demonstrated by the Latitude/Lon...Show more An issue was discovered on Lutron Quantum BACnet Integration 2.0 (firmware 3.2.243) devices. Remote attackers can obtain potentially sensitive information via a /DbXmlInfo.xml request, as demonstrated by the Latitude/Longitude of the device.Show less