Not a U.S. government website. NDD is an independent vulnerability database by Volerion and is not affiliated with or endorsed by NIST or NVD.
VOLERION
Volerion Security Research

NOT DEFERRED DATABASE

VULNERABILITIES

CVE-2018-11681 Details

Description

Default and unremovable support credentials (user:nwk password:nwk2) allow attackers to gain total super user control of an IoT device through a TELNET session to products using the RadioRA 2 Lutron integration protocol Revision M to Revision Y. NOTE: The vendor disputes this id as not being a vulnerability because what can be done through the ports revolve around controlling lighting, not code execution. A certain set of commands are listed, which bear some similarity to code, but they are not arbitrary and do not allow admin-level control of a machine

Metrics

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.

URLSource(s)Tag(s)
http://sadfud.me/explotos/CVE-2018-11629 CVEThird Party Advisory
https://reversecodes.wordpress.com/2018/06/02/0-day-tomando-el-control-de-las-instalaciones-de-la-nasa-en-cabo-canaveral/ CVEMitigationThird Party Advisory
http://www.lutron.com/TechnicalDocumentLibrary/040249.pdf CVE
http://sadfud.me/explotos/CVE-2018-11629 [email protected]Third Party Advisory
https://reversecodes.wordpress.com/2018/06/02/0-day-tomando-el-control-de-las-instalaciones-de-la-nasa-en-cabo-canaveral/ [email protected]MitigationThird Party Advisory

see all 6 references

Weakness Enumeration

CWE-IDCWE NameSource
CWE-798Use of Hard-coded Credentials[email protected]
CWE-798Use of Hard-coded CredentialsCISA-ADP

Affected Products

ProductVersions

Change History

14 change records found show changes

QUICK INFO

CVE Dictionary Entry:
CVE-2018-11681
NVD Published Date:
Jun 2, 2018
NVD Last Modified:
Jun 17, 2026
Source:
[email protected]
CVE-2018-11681 Details - Not Deferred