<?xml version="1.0" encoding="UTF-8" ?>
<?xml-stylesheet type="text/xsl" href="/rss-style.xsl"?>
<rss version="2.0" xmlns:atom="http://www.w3.org/2005/Atom" xmlns:content="http://purl.org/rss/1.0/modules/content/" xmlns:media="http://search.yahoo.com/mrss/" xmlns:dc="http://purl.org/dc/elements/1.1/">
<channel>
<title><![CDATA[Team IT Security - 📰 Alle Kategorien]]></title>
<link><![CDATA[https://tsecurity.de/export/rss/alle-kategorien.xml?q=reactprestanda+sluta+spilla+energi%2F]]></link>
<description><![CDATA[Das Gesamte Cyber Threat Intelligence Feed-Archiv von TSecurity.de. Alle Nachrichten, Sicherheitsmeldungen, Videos, Downloads und Analysen in einer zentralen Übersicht.]]></description>
<language>de-DE</language>
<lastBuildDate>Thu, 30 Jul 2026 20:19:24 +0200</lastBuildDate>
<pubDate>Thu, 30 Jul 2026 20:19:24 +0200</pubDate>
<ttl>15</ttl>
<copyright>2026 Team IT Security</copyright>
<managingEditor>lakandor@tsecurity.de (Horus Sirius)</managingEditor>
<webMaster>lakandor@tsecurity.de (Horus Sirius)</webMaster>
<category>IT Security</category>
<category>Cybersecurity</category>
<category>Nachrichten</category>
<generator>Team IT Security RSS Generator v2.0</generator>
<image>
<url>https://tsecurity.de/favicon.ico</url>
<title><![CDATA[Team IT Security - 📰 Alle Kategorien]]></title>
<link><![CDATA[https://tsecurity.de/export/rss/alle-kategorien.xml?q=reactprestanda+sluta+spilla+energi%2F]]></link>
</image>
<atom:link href="https://tsecurity.de/export/rss/it-security.xml?q=reactprestanda+sluta+spilla+energi%2F" rel="self" type="application/rss+xml" />
<item>
<title><![CDATA[Carbon footprint of LLM fine tuning — a case study]]></title>
<description><![CDATA[Carbon Footprint of LLM Fine Tuning — A Case StudyI got surprising results when I measured the carbon emissions from instruction fine tuning an LLMPhoto by Ingmar H on UnsplashI recently LoRA fine-tuned a Danish LLM called Munin-7b-alpha on an instruction fine tuning dataset called SkoleGPT-instr...]]></description>
<link>https://tsecurity.de/de/2041867/ai-nachrichten/carbon-footprint-of-llm-fine-tuning-a-case-study/</link>
<guid isPermaLink="true">https://tsecurity.de/de/2041867/ai-nachrichten/carbon-footprint-of-llm-fine-tuning-a-case-study/</guid>
<pubDate>Thu, 22 Feb 2024 07:53:40 +0100</pubDate>
<category>🔧 AI Nachrichten</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[<h3>Carbon Footprint of LLM Fine Tuning — A Case Study</h3><h4>I got surprising results when I measured the carbon emissions from instruction fine tuning an LLM</h4><figure><img alt="" src="https://cdn-images-1.medium.com/max/1024/1*KKCpzsegj4QU5V5TgozZTQ@2x.jpeg"><figcaption>Photo by Ingmar H on Unsplash</figcaption></figure><p>I recently LoRA fine-tuned a Danish LLM called Munin-7b-alpha on an instruction fine tuning dataset called SkoleGPT-instruct. During the fine tuning procedure, I measured the energy consumption and computed the carbon footprint. In this article, I present the surprising results. You can find the model <a href="https://huggingface.co/ThatsGroes/munin-SkoleGPTOpenOrca-7b-16bit">here</a>.</p><h3>Introduction</h3><p>Munin-7b-alpha is a pre-trained model (or a so-called foundation model), which has been trained solely to generate text. To make them suitable for a chat setup, pre-trained models need to be good at following instructions, which requires a subsequent training step called instruction fine tuning.</p><p>As opposed to pre-training, which requires massive amounts of unlabeled text data on which the model trains in a self-supervised fashion, instruction fine tuning requires a relatively modest amount of data, which in turn must be carefully curated and annotated.</p><p>It is a fune-tuning procedure that I report on in this article.</p><p><a href="https://towardsdatascience.com/set-up-a-local-llm-on-cpu-with-chat-ui-in-15-minutes-4cdc741408df">Set up a local LLM on CPU with chat UI in 15 minutes</a></p><h3>Methodology</h3><p>The Munin-7b-alpha has 7 billion parameters and the instruction dataset that I used consists of 21,300 samples. That is, 21,300 examples of a prompt and a good answer.</p><p>Using an slightly adapted version of <a href="https://github.com/alexandrainst/d3a-llm-workshop">this fantastic model fine tuning notebook</a>, I trained a LoRA for 1 epoch, i.e. I showed the model each sample once.</p><p>LoRA – low rank adaptation – is an efficient fine tuning technique for adapting LLMs to specific tasks. <a href="https://huggingface.co/docs/peft/en/package_reference/lora">Hugging Face</a> provides a succinct description of the technique:</p><p>“Low-Rank Adaptation (LoRA) is a PEFT [parameter efficient fine tuning] method that decomposes a large matrix into two smaller low-rank matrices in the attention layers. This drastically reduces the number of parameters that need to be fine-tuned.”</p><p>The model trained on a single Nvidia RTX A4000 GPU, which is a consumer grade GPU with 16 GB memory – just enough memory for LoRA fine tuning of this model.</p><p>I measured energy consumption with the Python package CodeCarbon. CodeCarbon is an extremely light weight and easy-to-use package that let’s you measure the energy consumption of a Python script, function or method with just two lines of code. Read more about how to use it here:</p><p><a href="https://towardsdatascience.com/how-to-estimate-and-reduce-the-carbon-footprint-of-machine-learning-models-49f24510880">How to estimate and reduce the carbon footprint of machine learning models</a></p><p>Aside from energy consumption, CodeCarbon also estimates the carbon footprint of the energy your computing procedure consumes, but I found the numbers to appear inaccurate. This is likely because CodeCarbon uses a hardcoded average carbon intensity (CO2e per produced KWh) of your geographic region and not an near real time carbon intensity. So I went to a website called Energi Data Service, which lets you download fine grained electricity emissions data from the Danish grid. By multiplying the energy consumption measurements obtained with CodeCarbon by the carbon intensity of electricity in the grid during the hours the model trained, I obtained the carbon footprint of the training.</p><p><a href="https://towardsdatascience.com/chatgpts-energy-use-per-query-9383b8654487">ChatGPT’s energy use per query</a></p><h3>Results</h3><p>The fine tuning process took just shy of 4 hours and consumed a total of 0.694 KWh – the combined GPU, CPU and RAM consumption as per estimates produced with the Python package CodeCarbon.</p><p>During the hours the model trained, the average C02e emissions per produced KWh was 82.5 g as per Energi Data Service (license: “The Licensor grants you a worldwide, free, non-exclusive and otherwise unrestricted licence to use the Data” [1]).</p><p>Thus, the fine tuning emitted a minuscule 57 grams of CO2e (0.694 KWh * 82.5 g).</p><p>For comparison, the average Dane emits 11 TONS CO2e per year.</p><p>Generating a single image with generative AI has been found in a research study to consume 2.9 Wh on average [2]. So for the amount of energy it took to instruction fine-tune the LLM, you can generate a mere 239 images.</p><p>If you’re wondering if such a short and efficient fine-tuning procedure yielded a better model, the answer is a clear “yes”:</p><p>According to the <a href="https://scandeval.com/mainland-scandinavian-nlg/">ScandEval leader board</a> on natural language generation, the pre-trained model scores an average of 43.44 on Danish tasks and the fine tuned model scores an average of 47.55. A gain of 9.45 percent. As of this writing, that’s the difference between a 5th place and a 7th place on the leader board.</p><p><a href="https://towardsdatascience.com/how-to-make-a-pytorch-transformer-for-time-series-forecasting-69e073d4061e">How to make a PyTorch Transformer for time series forecasting</a></p><h3>Discussion</h3><p>It’s surprising to me that it did not require more compute, energy, and emissions to perform the fine tuning.</p><p>I expect my findings to scale linearly with the amount of samples if holding other variables constant (e.g. using a similar GPU, training method etc.). I.e. if you fine tune on twice the amount of samples, or for double the number of epochs, I expect the energy consumption to double.</p><p>The energy consumption will likely be significantly higher for a 70 billion parameter model, thus leading to higher emissions, but emissions would probably still very modest in the grand scheme of things.</p><p>Further, the energy consumption would likely be higher if I hadn’t used LoRA.</p><h3>Conclusion</h3><p>Using the instruction fine-tuning technique LoRA is indeed efficient—both in terms of how long it takes, how much compute (eg GPU RAM) you need, and how much carbon it emits.</p><p>Instruction fine tuning a 7B LLM with LoRA on 21,300 samples for one epoch took four hours and emitted 57 gram CO2e—a tiny amount.</p><p>That’s it! I hope you enjoyed the story. Let me know what you think!</p><p>Get the benefits of Medium and support my writing by signing up for a <a href="https://kaspergroesludvigsen.medium.com/membership">Medium membership HERE</a>.</p><p>Follow me for more on AI and sustainability and <a href="https://kaspergroesludvigsen.medium.com/subscribe">subscribe</a> to get my stories via email when I publish.</p><p>I also sometimes write about <a href="https://towardsdatascience.com/how-to-make-a-pytorch-transformer-for-time-series-forecasting-69e073d4061e">time series forecasting</a>.</p><p>And feel free to connect on <a href="https://www.linkedin.com/in/kaspergroesludvigsen">LinkedIn</a>.</p><h3>References</h3><p>[1] https://www.energidataservice.dk/Conditions_for_use_of_Danish_public_sector_data-License_for_use_of_data_in_ED.pdf</p><p>[2] “Power Hungry Processing: Watts Driving the Cost of AI Deployment?” by Luccioni et al</p><img src="https://medium.com/_/stat?event=post.clientViewed&amp;referrerSource=full_rss&amp;postId=7703afc716a9" width="1" height="1" alt=""><hr><p><a href="https://towardsdatascience.com/carbon-footprint-of-llm-fine-tuning-a-case-study-7703afc716a9">Carbon footprint of LLM fine tuning — a case study</a> was originally published in <a href="https://towardsdatascience.com/">Towards Data Science</a> on Medium, where people are continuing the conversation by highlighting and responding to this story.</p>]]></content:encoded>
</item>
<item>
<title><![CDATA[Detected: Hacktivist of Garuda targets the website of Disnakertrans Provinsi DKI Jakarta]]></title>
<description><![CDATA[Category: Defacement Content: Hacktivist of Garuda claims to have defaced the website of Dinas Ketenagakerjaan Transmigrasi dan Energi Provinsi DKI Jakarta Source: telegram Source Link: https://t.me/HacktivistOfGarudaOfficial/1205 Threat Actor: Hacktivist of Garuda Victimology Country : Indonesia...]]></description>
<link>https://tsecurity.de/de/1953254/it-security-nachrichten/detected-hacktivist-of-garuda-targets-the-website-of-disnakertrans-provinsi-dki-jakarta/</link>
<guid isPermaLink="true">https://tsecurity.de/de/1953254/it-security-nachrichten/detected-hacktivist-of-garuda-targets-the-website-of-disnakertrans-provinsi-dki-jakarta/</guid>
<pubDate>Wed, 06 Dec 2023 23:05:00 +0100</pubDate>
<category>📰 IT Security Nachrichten</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[Category: Defacement Content: Hacktivist of Garuda claims to have defaced the website of Dinas Ketenagakerjaan Transmigrasi dan Energi Provinsi DKI Jakarta Source: telegram Source Link: https://t.me/HacktivistOfGarudaOfficial/1205 Threat Actor: Hacktivist of Garuda Victimology Country : Indonesia Industry : Government Administration Organization : dinas tenaga kerja, transmigrasi dan energi provinsi dki jakarta]]></content:encoded>
</item>
<item>
<title><![CDATA[netdata, the open-source real-time performance and health monitoring, released v1.15 !]]></title>
<description><![CDATA[Hi all,  we just released netdata v1.15 ! This release contains 11 Bugs Fixes and 30 Improvements. We are very happy and proud to include two major improvements in this release, an aggregated node view and the new database engine. You can read about Netdata Cloud and the future of netdata here: h...]]></description>
<link>https://tsecurity.de/de/515007/linux-tipps/netdata-the-open-source-real-time-performance-and-health-monitoring-released-v115/</link>
<guid isPermaLink="true">https://tsecurity.de/de/515007/linux-tipps/netdata-the-open-source-real-time-performance-and-health-monitoring-released-v115/</guid>
<pubDate>Thu, 30 May 2019 09:00:16 +0200</pubDate>
<category>🐧 Linux Tipps</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[
<!-- SC_OFF --><div class="md">
<p>Hi all, </p> <p>we just released <strong>netdata v1.15</strong> !</p> <p>This release contains 11 Bugs Fixes and 30 Improvements.</p> <p>We are very happy and proud to include two major improvements in this release, an aggregated node view and the new database engine.</p> <p>You can read about Netdata Cloud and the future of netdata here: <a href="https://blog.netdata.cloud/posts/netdata-cloud-announcement/">https://blog.netdata.cloud/posts/netdata-cloud-announcement/</a></p> <p><strong>Other major additions</strong></p> <p>We have added support for the <strong>AWS Kinesis backend</strong> and new collectors for <strong>OpenVPN</strong>, the <strong>Tengine web server</strong>, <strong>ScaleIO (VxFlex OS)</strong>, <strong>ioping-like latency metrics</strong> and <strong>Energi Core node instances</strong>.</p> <p>We now have a new, <strong>"text-only" chart type</strong>, <strong>cpu limits for v2 cgroups</strong>, <strong>docker swarm metrics</strong> and improved documentation.</p> <p>We continued improving the <strong>Kubernetes helmchart</strong> with liveness probes for slaves, persistence options, a fix for a <strong>Cannot allocate memory</strong> issue and easy configuration for the kubelet, kube-proxy and coredns collectors.</p> <p>Finally, we built a process to quickly replace any problematic nightly builds and added more automated CI tests to prevent such builds from being published in the first place.</p> <p><strong>Improvements</strong></p> <ul>
<li>Support for aggregate node view, </li> <li>Database engine, </li> <li>New collector modules: <ul>
<li>Go.d collectors for OpenVPN, the Tengine web server and ScaleIO (VxFlex OS) instances,</li> <li>Monitor disk access latency like ioping does, </li> </ul>
</li> <li>Energi Core daemon monitoring, suits other Bitcoin forks, </li> <li>Collector improvements: <ul>
<li>Add docker swarm manager metrics to the go.d docker_engine collector,</li> <li>Implement unified cgroup cpu limit, </li> <li>python.d.plugin: Allow monitoring of HTTP(S) endpoints which require POST data and make the UrlService more flexible, </li> </ul>
</li> <li>Support the AWS Kinesis backend for long-term storage,</li> <li>Add a new "text-only" chart renderer,</li> <li>Packaging and CI improvements: <ul>
<li>We can now fix more quickly any problematic published builds via a new manual deployment procedure,</li> <li>We added more tests to our nightly builds, to catch more errors before publishing images,</li> </ul>
</li> <li>API Improvements: <ul>
<li>Smarter caching of API calls. Do not cache alarms and info api calls and extend no-cache headers,</li> <li>Extend the api/v1/info call response with system and collector information, </li> <li>k6 script for API load testing,</li> </ul>
</li> <li>Kubernetes helmchart improvements: <ul>
<li>Added the init container, where sysctl params could be managed, to bypass the Cannot allocate memory issue,</li> <li>Better startup/shutdown of slaves and reduced memory usage with liveness/readiness probes and default memory mode none,</li> <li>Added the option of overriding the default settings for kubelet, kubeproxy and coredns collectors via values.yaml,</li> <li>Make the use of persistent volumes optional, add apiVersion to fix linting errors and correct the location of the env field,</li> <li>Fix incorrect parameter names in the README,</li> </ul>
</li> <li>Documentation improvements</li> </ul>
<p><strong>Bug Fixes</strong></p> <ul>
<li>Prowl notifications were not being sent, unless another notification method was also active,</li> <li>Fix exception handling in the python.d plugin,</li> <li>The node applications group did not include all node processes,</li> <li>Installation would show incorrect message "FAILED Cannot install netdata init service." in some cases,</li> <li>The nvidia_smi collector displayed incorrect power usage,</li> <li>The python.d plugin would sometimes hang, because it lacked a connect timeout,</li> <li>The mongodb collector raised errors due to various KeyErrors,</li> <li>The smartd_log collector would show incorrect temperature values,</li> <li>charts.d plugins would fail on docker, when using the timeout command,</li> <li>Docker image had plugins not executable by user netdata,</li> <li>Docker image was missing the lsns command, used to match network interfaces to containers.</li> </ul>
<hr>
<p><a href="https://github.com/netdata/netdata/releases">Check the release log at github</a>.</p> <p>If you are new to netdata, <a href="https://my-netdata.io/">check a few live demos at its home page</a> and the <a href="https://github.com/netdata/netdata">project home at github</a>.</p> <p>Netdata is FOSS (Free Open Source Software), released under GPLv3+.</p> <blockquote> <p>Enjoy real-time performance and health monitoring!</p> </blockquote> </div>
<!-- SC_ON -->   submitted by   <a href="https://www.reddit.com/user/ktsaou"> /u/ktsaou </a> <br><span><a href="https://www.reddit.com/r/linux/comments/buq0r8/netdata_the_opensource_realtime_performance_and/">[link]</a></span>   <span><a href="https://www.reddit.com/r/linux/comments/buq0r8/netdata_the_opensource_realtime_performance_and/">[comments]</a></span>
]]></content:encoded>
</item>
<item>
<title><![CDATA[Lutron radioRA2 Telnet Default Credentials schwache Authentisierung]]></title>
<description><![CDATA[In Lutron radioRA2 wurde eine sehr kritische Schwachstelle entdeckt. Das betrifft eine unbekannte Funktion der Komponente Telnet. Dank Manipulation mit einer unbekannten Eingabe kann eine schwache Authentisierung-Schwachstelle (Default Credentials) ausgenutzt werden. CWE definiert das Problem als...]]></description>
<link>https://tsecurity.de/de/321616/sicherheitsluecken/lutron-radiora2-telnet-default-credentials-schwache-authentisierung/</link>
<guid isPermaLink="true">https://tsecurity.de/de/321616/sicherheitsluecken/lutron-radiora2-telnet-default-credentials-schwache-authentisierung/</guid>
<pubDate>Sun, 03 Jun 2018 14:34:40 +0200</pubDate>
<category>🕵️ Sicherheitslücken</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[
<p>In Lutron radioRA2 wurde eine sehr kritische Schwachstelle entdeckt. Das betrifft eine unbekannte Funktion der Komponente <em>Telnet</em>. Dank Manipulation mit einer unbekannten Eingabe kann eine schwache Authentisierung-Schwachstelle (Default Credentials) ausgenutzt werden. CWE definiert das Problem als <a href="https://cwe.mitre.org/data/definitions/798.html">CWE-798</a>. Dies hat Einfluss auf Vertraulichkeit, Integrität und Verfügbarkeit. Die Zusammenfassung von CVE lautet:<br></p>
<blockquote lang="en">Default and unremovable support credentials (user:nwk password:nwk2) allow attackers to gain total super user control of an IoT device through a TELNET session to products using the RadioRA 2 Lutron integration protocol Revision M to Revision Y.</blockquote>
<p>Die Schwachstelle wurde am 02.06.2018 öffentlich gemacht. Die Verwundbarkeit wird seit dem 02.06.2018 als <a href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-11681">CVE-2018-11681</a> geführt. Der Angriff kann über das Netzwerk angegangen werden. Um eine Ausnutzung durchzusetzen, muss keine spezifische Authentisierung umgesetzt werden. Technische Details oder ein Exploit zur Schwachstelle sind nicht verfügbar. Ein Exploit zur Schwachstelle wird momentan etwa USD $0-$5k kosten (<a href="https://vuldb.com/?doc.exploitprices">Preisberechnung vom 06/03/2018</a>). </p>
<p></p>
<p>Es sind keine Informationen bezüglich Gegenmassnahmen bekannt. Der Einsatz eines alternativen Produkts bietet sich im Zweifelsfall an.</p>
<p></p>
<h2>Betroffen</h2>
<ul>
<li>GRAFIK Eye QS </li>
<li>seeTouch Keypad  </li>
<li>Tabletop seeTouch Keypad </li>
<li>ArchitraveTM Keypad </li>
<li>Signature SeriesTM Keypad </li>
<li>Sivoia QS Shade  </li>
<li>Maestro Dimmer + Switch </li>
<li>Maestro Fan Speed Control </li>
<li>Visor Control Receiver </li>
<li>Hybrid Keypad </li>
<li>Pico Wireless Control </li>
<li>Radio Powr SavrTM Sensor </li>
<li>HVAC Controller </li>
<li>Remote Power Module </li>
<li>Energi Savr NodeTM QS EcoSystem</li>
<li>Energi Savr NodeTM QS Motor Module</li>
<li>Wallbox Input Closure Interface </li>
<li>Wireless Temperature Sensor </li>
<li>Energi Savr NodeTM QS Phase Adaptive</li>
<li>QS Input/Output Interface </li>
<li>QS Sensor Module</li>
</ul>
<h2>CPE</h2>
<ul><li><a href="https://web.nvd.nist.gov/view/vuln/search-results?cpe=cpe%3A%2Fa%3Alutron%3Aradiora2&amp;page_num=0&amp;cid=3">cpe:/a:lutron:radiora2</a></li></ul>
<h2>CVSSv3</h2>
<span>VulDB Base Score</span>: <a href="https://www.first.org/cvss/specification-document#2-Base-Metrics">9.8</a><br><span>VulDB Temp Score</span>: <a href="https://www.first.org/cvss/specification-document#3-Temporal-Metrics">9.8</a><br><span>VulDB Vector</span>: <a href="https://www.first.org/cvss/specification-document#6-Vector-String">CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:X/RL:X/RC:X</a><br><span>VulDB Zuverlässigkeit</span>: High<br><br><span>Researcher Base Score</span>: 9.8<br><span>Researcher Vector</span>: <a href="https://www.first.org/cvss/specification-document#6-Vector-String">CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:X/RL:X/RC:X</a><br><h2>CVSSv2</h2>
<span>VulDB Base Score</span>: <a href="https://www.first.org/cvss/v2/guide#2-1-Base-Metrics">9.3 (CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C)</a><br><span>VulDB Temp Score</span>: <a href="https://www.first.org/cvss/v2/guide#2-2-Temporal-Metrics">9.3 (CVSS2#E:ND/RL:ND/RC:ND)</a><br><span>VulDB Zuverlässigkeit</span>: High<br><br><h2>Exploiting</h2>
<span>Klasse</span>: Schwache Authentisierung / Default Credentials (<a href="https://cwe.mitre.org/data/definitions/798.html">CWE-798</a>)<br><span>Lokal</span>: Nein<br><span>Remote</span>: Ja<br><br><span>Verfügbarkeit</span>: Nein<br><br><span>Preisentwicklung</span>: gleichbleibend<br><span>Aktuelle Preisschätzung</span>: <span>$0-$5k (0-day) / $0-$5k (Heute)</span><br><br><h2>Gegenmassnahmen</h2>
<span>Empfehlung</span>: keine Massnahme bekannt<br><span>0-Day Time</span>: 0 Tage seit gefunden<br><h2>Timeline</h2>
<span>02.06.2018</span>  Advisory veröffentlicht<br><span>02.06.2018</span>  <a href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-11681">CVE zugewiesen</a><br><span>03.06.2018</span>  <a href="https://vuldb.com/?id.118801">VulDB Eintrag erstellt</a><br><span>03.06.2018</span>  <a href="https://vuldb.com/?id.118801">VulDB letzte Aktualisierung</a><br><h2>Quellen</h2>
<br><span>CVE</span>: CVE-2018-11681 <a href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-11681">(mitre.org)</a> <a href="https://nvd.nist.gov/vuln/detail/CVE-2018-11681">(nvd.nist.org)</a> <a href="https://www.cvedetails.com/cve/CVE-2018-11681/">(cvedetails.com)</a><br><h2>Eintrag</h2>
<span>Erstellt</span>: 03.06.2018<br><span>Eintrag</span>: 73.2% komplett<br>
]]></content:encoded>
</item>
<item>
<title><![CDATA[Lutron stanza bis Y Telnet Default Credentials schwache Authentisierung]]></title>
<description><![CDATA[Eine sehr kritische Schwachstelle wurde in Lutron stanza bis Y entdeckt. Dies betrifft eine unbekannte Funktion der Komponente Telnet. Mit der Manipulation mit einer unbekannten Eingabe kann eine schwache Authentisierung-Schwachstelle (Default Credentials) ausgenutzt werden. Klassifiziert wurde d...]]></description>
<link>https://tsecurity.de/de/321617/sicherheitsluecken/lutron-stanza-bis-y-telnet-default-credentials-schwache-authentisierung/</link>
<guid isPermaLink="true">https://tsecurity.de/de/321617/sicherheitsluecken/lutron-stanza-bis-y-telnet-default-credentials-schwache-authentisierung/</guid>
<pubDate>Sun, 03 Jun 2018 14:34:40 +0200</pubDate>
<category>🕵️ Sicherheitslücken</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[
<p>Eine sehr kritische Schwachstelle wurde in Lutron stanza bis Y entdeckt. Dies betrifft eine unbekannte Funktion der Komponente <em>Telnet</em>. Mit der Manipulation mit einer unbekannten Eingabe kann eine schwache Authentisierung-Schwachstelle (Default Credentials) ausgenutzt werden. Klassifiziert wurde die Schwachstelle durch CWE als <a href="https://cwe.mitre.org/data/definitions/798.html">CWE-798</a>. Dies wirkt sich aus auf Vertraulichkeit, Integrität und Verfügbarkeit. CVE fasst zusammen:<br></p>
<blockquote lang="en">Default and unremovable support credentials allow attackers to gain total super user control of an IoT device through a TELNET session to products using the Stanza Lutron integration protocol Revision M to Revision Y.</blockquote>
<p>Die Schwachstelle wurde am 02.06.2018 veröffentlicht. Die Identifikation der Schwachstelle findet seit dem 02.06.2018 als <a href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-11682">CVE-2018-11682</a> statt. Der Angriff kann über das Netzwerk passieren. Das Ausnutzen erfordert keine spezifische Authentisierung. Nicht vorhanden sind sowohl technische Details als auch ein Exploit zur Schwachstelle. Als Preis für einen Exploit ist zur Zeit ungefähr mit USD $0-$5k zu rechnen (<a href="https://vuldb.com/?doc.exploitprices">Preisberechnung vom 06/03/2018</a>). </p>
<p></p>
<p>Es sind keine Informationen bezüglich Gegenmassnahmen bekannt. Der Einsatz eines alternativen Produkts bietet sich im Zweifelsfall an.</p>
<p></p>
<h2>Betroffen</h2>
<ul>
<li>GRAFIK Eye QS </li>
<li>seeTouch Keypad  </li>
<li>Tabletop seeTouch Keypad </li>
<li>ArchitraveTM Keypad </li>
<li>Signature SeriesTM Keypad </li>
<li>Sivoia QS Shade  </li>
<li>Maestro Dimmer + Switch </li>
<li>Maestro Fan Speed Control </li>
<li>Visor Control Receiver </li>
<li>Hybrid Keypad </li>
<li>Pico Wireless Control </li>
<li>Radio Powr SavrTM Sensor </li>
<li>HVAC Controller </li>
<li>Remote Power Module </li>
<li>Energi Savr NodeTM QS EcoSystem</li>
<li>Energi Savr NodeTM QS Motor Module</li>
<li>Wallbox Input Closure Interface </li>
<li>Wireless Temperature Sensor </li>
<li>Energi Savr NodeTM QS Phase Adaptive</li>
<li>QS Input/Output Interface </li>
<li>QS Sensor Module</li>
</ul>
<h2>CPE</h2>
<ul><li><a href="https://web.nvd.nist.gov/view/vuln/search-results?cpe=cpe%3A%2Fa%3Alutron%3Astanza%3Ay&amp;page_num=0&amp;cid=3">cpe:/a:lutron:stanza:y</a></li></ul>
<h2>CVSSv3</h2>
<span>VulDB Base Score</span>: <a href="https://www.first.org/cvss/specification-document#2-Base-Metrics">9.8</a><br><span>VulDB Temp Score</span>: <a href="https://www.first.org/cvss/specification-document#3-Temporal-Metrics">9.8</a><br><span>VulDB Vector</span>: <a href="https://www.first.org/cvss/specification-document#6-Vector-String">CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:X/RL:X/RC:X</a><br><span>VulDB Zuverlässigkeit</span>: High<br><br><span>Researcher Base Score</span>: 9.8<br><span>Researcher Vector</span>: <a href="https://www.first.org/cvss/specification-document#6-Vector-String">CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:X/RL:X/RC:X</a><br><h2>CVSSv2</h2>
<span>VulDB Base Score</span>: <a href="https://www.first.org/cvss/v2/guide#2-1-Base-Metrics">9.3 (CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C)</a><br><span>VulDB Temp Score</span>: <a href="https://www.first.org/cvss/v2/guide#2-2-Temporal-Metrics">9.3 (CVSS2#E:ND/RL:ND/RC:ND)</a><br><span>VulDB Zuverlässigkeit</span>: High<br><br><h2>Exploiting</h2>
<span>Klasse</span>: Schwache Authentisierung / Default Credentials (<a href="https://cwe.mitre.org/data/definitions/798.html">CWE-798</a>)<br><span>Lokal</span>: Nein<br><span>Remote</span>: Ja<br><br><span>Verfügbarkeit</span>: Nein<br><br><span>Preisentwicklung</span>: gleichbleibend<br><span>Aktuelle Preisschätzung</span>: <span>$0-$5k (0-day) / $0-$5k (Heute)</span><br><br><h2>Gegenmassnahmen</h2>
<span>Empfehlung</span>: keine Massnahme bekannt<br><span>0-Day Time</span>: 0 Tage seit gefunden<br><h2>Timeline</h2>
<span>02.06.2018</span>  Advisory veröffentlicht<br><span>02.06.2018</span>  <a href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-11682">CVE zugewiesen</a><br><span>03.06.2018</span>  <a href="https://vuldb.com/?id.118802">VulDB Eintrag erstellt</a><br><span>03.06.2018</span>  <a href="https://vuldb.com/?id.118802">VulDB letzte Aktualisierung</a><br><h2>Quellen</h2>
<br><span>CVE</span>: CVE-2018-11682 <a href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-11682">(mitre.org)</a> <a href="https://nvd.nist.gov/vuln/detail/CVE-2018-11682">(nvd.nist.org)</a> <a href="https://www.cvedetails.com/cve/CVE-2018-11682/">(cvedetails.com)</a><br><h2>Eintrag</h2>
<span>Erstellt</span>: 03.06.2018<br><span>Eintrag</span>: 73.6% komplett<br>
]]></content:encoded>
</item>
<item>
<title><![CDATA[Lutron radioRA2/stanza/HomeworkQS Default Credentials schwache Authentisierung]]></title>
<description><![CDATA[In Lutron radioRA2, stanza sowie HomeworkQS wurde eine Schwachstelle ausgemacht. Sie wurde als sehr kritisch eingestuft. Dabei geht es um eine unbekannte Funktion. Durch das Beeinflussen mit einer unbekannten Eingabe kann eine schwache Authentisierung-Schwachstelle (Default Credentials) ausgenutz...]]></description>
<link>https://tsecurity.de/de/321566/sicherheitsluecken/lutron-radiora2stanzahomeworkqs-default-credentials-schwache-authentisierung/</link>
<guid isPermaLink="true">https://tsecurity.de/de/321566/sicherheitsluecken/lutron-radiora2stanzahomeworkqs-default-credentials-schwache-authentisierung/</guid>
<pubDate>Sun, 03 Jun 2018 13:19:26 +0200</pubDate>
<category>🕵️ Sicherheitslücken</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[
<p>In Lutron radioRA2, stanza sowie HomeworkQS wurde eine Schwachstelle ausgemacht. Sie wurde als sehr kritisch eingestuft. Dabei geht es um eine unbekannte Funktion. Durch das Beeinflussen mit einer unbekannten Eingabe kann eine schwache Authentisierung-Schwachstelle (Default Credentials) ausgenutzt werden. CWE definiert das Problem als <a href="https://cwe.mitre.org/data/definitions/798.html">CWE-798</a>. Auswirkungen sind zu beobachten für Vertraulichkeit, Integrität und Verfügbarkeit. CVE fasst zusammen:<br></p>
<blockquote lang="en">Default and unremovable support credentials (user:lutron password:integration) allow attackers to gain total super user control of an IoT device through a TELNET session to products using the HomeWorks QS Lutron integration protocol Revision M to Revision Y.</blockquote>
<p>Die Schwachstelle wurde am 02.06.2018 an die Öffentlichkeit getragen. Eine eindeutige Identifikation der Schwachstelle wird seit dem 31.05.2018 mit <a href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-11629">CVE-2018-11629</a> vorgenommen. Die Umsetzung des Angriffs kann dabei über das Netzwerk erfolgen. Um eine Ausnutzung durchzusetzen, muss keine spezifische Authentisierung umgesetzt werden. Nicht vorhanden sind sowohl technische Details als auch ein Exploit zur Schwachstelle. Als Preis für einen Exploit ist zur Zeit ungefähr mit USD $0-$5k zu rechnen (<a href="https://vuldb.com/?doc.exploitprices">Preisberechnung vom 06/03/2018</a>). </p>
<p></p>
<p>Es sind keine Informationen bezüglich Gegenmassnahmen bekannt. Der Einsatz eines alternativen Produkts bietet sich im Zweifelsfall an.</p>
<p></p>
<h2>Betroffen</h2>
<ul>
<li>GRAFIK Eye QS </li>
<li>seeTouch Keypad  </li>
<li>Tabletop seeTouch Keypad </li>
<li>ArchitraveTM Keypad </li>
<li>Signature SeriesTM Keypad </li>
<li>Sivoia QS Shade  </li>
<li>Maestro Dimmer + Switch </li>
<li>Maestro Fan Speed Control </li>
<li>Visor Control Receiver </li>
<li>Hybrid Keypad </li>
<li>Pico Wireless Control </li>
<li>Radio Powr SavrTM Sensor </li>
<li>HVAC Controller </li>
<li>Remote Power Module </li>
<li>Energi Savr NodeTM QS EcoSystem</li>
<li>Energi Savr NodeTM QS Motor Module</li>
<li>Wallbox Input Closure Interface </li>
<li>Wireless Temperature Sensor </li>
<li>Energi Savr NodeTM QS Phase Adaptive</li>
<li>QS Input/Output Interface </li>
<li>QS Sensor Module</li>
</ul>
<h2>CPE</h2>
<ul>
<li><a href="https://web.nvd.nist.gov/view/vuln/search-results?cpe=cpe%3A%2Fa%3Alutron%3Aradiora2&amp;page_num=0&amp;cid=3">cpe:/a:lutron:radiora2</a></li>
<li><a href="https://web.nvd.nist.gov/view/vuln/search-results?cpe=cpe%3A%2Fa%3Alutron%3Astanza&amp;page_num=0&amp;cid=3">cpe:/a:lutron:stanza</a></li>
<li><a href="https://web.nvd.nist.gov/view/vuln/search-results?cpe=cpe%3A%2Fa%3Alutron%3Ahomeworkqs&amp;page_num=0&amp;cid=3">cpe:/a:lutron:homeworkqs</a></li>
</ul>
<h2>CVSSv3</h2>
<span>VulDB Base Score</span>: <a href="https://www.first.org/cvss/specification-document#2-Base-Metrics">9.8</a><br><span>VulDB Temp Score</span>: <a href="https://www.first.org/cvss/specification-document#3-Temporal-Metrics">9.8</a><br><span>VulDB Vector</span>: <a href="https://www.first.org/cvss/specification-document#6-Vector-String">CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:X/RL:X/RC:X</a><br><span>VulDB Zuverlässigkeit</span>: High<br><br><span>Researcher Base Score</span>: 9.8<br><span>Researcher Vector</span>: <a href="https://www.first.org/cvss/specification-document#6-Vector-String">CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:X/RL:X/RC:X</a><br><h2>CVSSv2</h2>
<span>VulDB Base Score</span>: <a href="https://www.first.org/cvss/v2/guide#2-1-Base-Metrics">9.3 (CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C)</a><br><span>VulDB Temp Score</span>: <a href="https://www.first.org/cvss/v2/guide#2-2-Temporal-Metrics">9.3 (CVSS2#E:ND/RL:ND/RC:ND)</a><br><span>VulDB Zuverlässigkeit</span>: High<br><br><h2>Exploiting</h2>
<span>Klasse</span>: Schwache Authentisierung / Default Credentials (<a href="https://cwe.mitre.org/data/definitions/798.html">CWE-798</a>)<br><span>Lokal</span>: Nein<br><span>Remote</span>: Ja<br><br><span>Verfügbarkeit</span>: Nein<br><br><span>Preisentwicklung</span>: gleichbleibend<br><span>Aktuelle Preisschätzung</span>: <span>$0-$5k (0-day) / $0-$5k (Heute)</span><br><br><h2>Gegenmassnahmen</h2>
<span>Empfehlung</span>: keine Massnahme bekannt<br><span>0-Day Time</span>: 0 Tage seit gefunden<br><h2>Timeline</h2>
<span>31.05.2018</span>  <a href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-11629">CVE zugewiesen</a><br><span>02.06.2018</span>  Advisory veröffentlicht<br><span>03.06.2018</span>  <a href="https://vuldb.com/?id.118798">VulDB Eintrag erstellt</a><br><span>03.06.2018</span>  <a href="https://vuldb.com/?id.118798">VulDB letzte Aktualisierung</a><br><h2>Quellen</h2>
<br><span>CVE</span>: CVE-2018-11629 <a href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-11629">(mitre.org)</a> <a href="https://nvd.nist.gov/vuln/detail/CVE-2018-11629">(nvd.nist.org)</a> <a href="https://www.cvedetails.com/cve/CVE-2018-11629/">(cvedetails.com)</a><br><h2>Eintrag</h2>
<span>Erstellt</span>: 03.06.2018<br><span>Eintrag</span>: 72.8% komplett<br>
]]></content:encoded>
</item>
</channel>
</rss>
<!-- Generated in 0,04ms -->