PatchTheCVE: lutronhttps://patchthecve.com/CVEs with upgrade or downgrade fix stepsCVE-2018-11682: Default and unremovable support credentials allow attackers to gain total super user control of an IoT device https://patchthecve.com/cve/CVE-2018-11682.htmlhttps://patchthecve.com/cve/CVE-2018-11682.htmlWed, 17 Jun 2026 01:36:21 +0000CRITICAL 9.8: Default and unremovable support credentials allow attackers to gain total super user control of an IoT device through a TELNET session to products using the Stanza Lutron integration protocol Revision M to Revision Y. NOTE: The vendor disputes this id as not being a vulnerability because what can beCVE-2018-11681: Default and unremovable support credentials (user:nwk password:nwk2) allow attackers to gain total super user https://patchthecve.com/cve/CVE-2018-11681.htmlhttps://patchthecve.com/cve/CVE-2018-11681.htmlWed, 17 Jun 2026 01:36:20 +0000CRITICAL 9.8: Default and unremovable support credentials (user:nwk password:nwk2) allow attackers to gain total super user control of an IoT device through a TELNET session to products using the RadioRA 2 Lutron integration protocol Revision M to Revision Y. NOTE: The vendor disputes this id as not being a vulneCVE-2018-11629: Default and unremovable support credentials (user:lutron password:integration) allow attackers to gain total shttps://patchthecve.com/cve/CVE-2018-11629.htmlhttps://patchthecve.com/cve/CVE-2018-11629.htmlWed, 17 Jun 2026 01:36:16 +0000CRITICAL 9.8: Default and unremovable support credentials (user:lutron password:integration) allow attackers to gain total super user control of an IoT device through a TELNET session to products using the HomeWorks QS Lutron integration protocol Revision M to Revision Y. NOTE: The vendor disputes this id as not CVE-2018-8880: Lutron Quantum BACnet Integration 2.0 (firmware 3.2.243) doesn't check for correct user authentication before https://patchthecve.com/cve/CVE-2018-8880.htmlhttps://patchthecve.com/cve/CVE-2018-8880.htmlWed, 17 Jun 2026 02:05:34 +0000HIGH 7.5: Lutron Quantum BACnet Integration 2.0 (firmware 3.2.243) doesn't check for correct user authentication before showing the /deviceIP information, which leads to internal network information disclosure.CVE-2018-7276: An issue was discovered on Lutron Quantum BACnet Integration 2.0 (firmware 3.2.243) deviceshttps://patchthecve.com/cve/CVE-2018-7276.htmlhttps://patchthecve.com/cve/CVE-2018-7276.htmlWed, 17 Jun 2026 02:02:56 +0000HIGH 7.5: An issue was discovered on Lutron Quantum BACnet Integration 2.0 (firmware 3.2.243) devices. Remote attackers can obtain potentially sensitive information via a /DbXmlInfo.xml request, as demonstrated by the Latitude/Longitude of the device.