cbcvebase.
CVE-2018-8880
published 2018-04-23

CVE-2018-8880: Lutron Quantum BACnet Integration 2.0 (firmware 3.2.243) doesn't check for correct user authentication before showing the /deviceIP information, which leads to…

PriorityP259high7.5CVSS 3.0
AVNACLPRNUINSUCHINAN
EXPLOIT
EPSS
14.05%
96.1th percentile
Lutron Quantum BACnet Integration 2.0 (firmware 3.2.243) doesn't check for correct user authentication before showing the /deviceIP information, which leads to internal network information disclosure.

Affected

1 ranges
VendorProductVersion rangeFixed in
lutronquantum_bacnet_integration_firmware——

Detection & IOCsextracted from sources · hover to see the quote

path/deviceIP↗
otherhtml:"LUTRON"↗
port51023↗
  • →Detect unauthenticated HTTP GET requests to the /deviceIP endpoint on Lutron Quantum devices; no session cookie or Authorization header will be present in the request. ↗
  • →The vulnerable endpoint /deviceIP returns HTML form fields including MacAddr, PRODFAM, PRODTYPE, SERNUM, GUID, CODEVER, IPADDR, SUBNETMK, GATEADDR, TELPORT, FTPPORT, and REMOTEPORT — presence of these field names in an HTTP response without authentication indicates successful exploitation. ↗
  • →Use the Shodan dork html:"LUTRON" to identify internet-exposed Lutron Quantum devices potentially vulnerable to this unauthenticated information disclosure. ↗
  • →The vulnerability requires no authentication — the device does not check for correct user authentication before serving /deviceIP, making any GET to that path an exploitation attempt. ↗
  • ·The exploit targets firmware version 3.2.243 specifically; other firmware versions may or may not be vulnerable and should be tested independently. ↗
  • ·The exploit is written for Python 2.7 and uses the requests and BeautifulSoup (lxml) libraries; it requires the target IP and port as runtime inputs, meaning the HTTP port may vary per deployment. ↗

CVSS provenance

nvdv3.07.5HIGHCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
nvdv2.05.0MEDIUMAV:N/AC:L/Au:N/C:P/I:N/A:N
CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.