Lucene search

MitreCVE-2019-15850

HistoryOct 17, 2019 - 2:15 p.m.

CVE-2019-15850

2019-10-1714:15:10

CWE-862

mitre

web.nvd.nist.gov

eq-3

homematic

ccu3

firmware

remote code execution

rega.runscript

authenticated attacker

system compromise

cve-2019-15850

nvd

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:S/C:C/I:C/A:C

CVSS3

8.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

AI Score

8.9

Confidence

High

EPSS

0.006

Percentile

78.7%

JSON

eQ-3 HomeMatic CCU3 firmware version 3.41.11 allows Remote Code Execution in the ReGa.runScript method. An authenticated attacker can easily execute code and compromise the system.

Affected configurations

Nvd

Node

eq-3homematic_ccu3_firmwareMatch3.41.11

AND

eq-3homematic_ccu3Match-

VendorProductVersionCPE
eq-3homematic_ccu3_firmware3.41.11cpe:2.3:o:eq-3:homematic_ccu3_firmware:3.41.11:*:*:*:*:*:*:*
eq-3homematic_ccu3-cpe:2.3:h:eq-3:homematic_ccu3:-:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
eq-3	homematic_ccu3_firmware	3.41.11	cpe:2.3:o:eq-3:homematic_ccu3_firmware:3.41.11:::::::*
eq-3	homematic_ccu3	-	cpe:2.3:h:eq-3:homematic_ccu3:-:::::::*

References

noskill1337.github.io/homematic-ccu3-remote-code-execution

www.eq-3.com/products/homematic.html

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:S/C:C/I:C/A:C

CVSS3

8.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

AI Score

8.9

Confidence

High

EPSS

0.006

Percentile

78.7%

JSON

Related for CVE-2019-15850