Lucene search

K
cve[email protected]CVE-2019-14423
HistoryOct 17, 2019 - 2:15 p.m.

CVE-2019-14423

2019-10-1714:15:10
CWE-78
web.nvd.nist.gov
24
cve-2019-14423
remote code execution
rce
cux-daemon
eq-3 homematic ccu-firmware
security vulnerability
authentication bypass
system command execution
root access

8.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

8.7 High

AI Score

Confidence

High

9 High

CVSS2

Access Vector

Access Complexity

Authentication

SINGLE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:S/C:C/I:C/A:C

0.013 Low

EPSS

Percentile

86.0%

A Remote Code Execution (RCE) issue in the addon CUx-Daemon 1.11a of the eQ-3 Homematic CCU-Firmware 2.35.16 until 2.45.6 allows remote authenticated attackers to execute system commands as root remotely via a simple HTTP request.

Affected configurations

NVD
Node
eq-3cux-daemonRange1.11a2.2.0
Node
eq-3ccu2_firmwareRange2.35.162.45.6
AND
eq-3ccu2Match-
CPENameOperatorVersion
eq-3:cux-daemoneq-3 cux-daemonle2.2.0

8.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

8.7 High

AI Score

Confidence

High

9 High

CVSS2

Access Vector

Access Complexity

Authentication

SINGLE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:S/C:C/I:C/A:C

0.013 Low

EPSS

Percentile

86.0%

Related for CVE-2019-14423