Default and unremovable support credentials (user:lutron password:integration) allow attackers to gain total super user control of an IoT device through a TELNET session to products using the Stanza Lutron integration protocol Revision M to Revision Y.

CVSSv3: AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:H/RL:U/RC:C/CR:H/IR:M/AR:M/MAV:N/MAC:L/MPR:N/MUI:N/MS:U/MC:H/MI:H/MA:H

CVSS Base Score: 9.8

Impact Subscore: 5.9

Exploitability Subscore: 3.9

CVSS Temporal Score: 9.8

CVSS Environmental Score: 9.8

Modified Impact Subscore: 5.9

Overall CVSS Score: 9.8

• GRAFIK Eye® QS

• seeTouch® Keypad

• Tabletop seeTouch® Keypad

• ArchitraveTM Keypad

• Signature SeriesTM Keypad

• Sivoia® QS Shade

• Maestro® Dimmer + Switch

• Maestro® Fan Speed Control

• Visor Control Receiver

• Hybrid Keypad

• Pico® Wireless Control

• Radio Powr SavrTM Sensor

• HVAC Controller

• Remote Power Module

• Energi Savr NodeTM QS/

• EcoSystem® (Int’l)

• Energi Savr NodeTM QS/

• Motor Module (Int’l)

• Wallbox Input Closure Interface

• Wireless Temperature Sensor

• Energi Savr NodeTM QS/

• Phase Adaptive (Int’l)

• QS Input/Output Interface

• QS Sensor Module