Lucene search

[email protected]CVE-2019-18937

HistoryNov 14, 2019 - 7:15 p.m.

CVE-2019-18937

2019-11-1419:15:13

CWE-306

[email protected]

web.nvd.nist.gov

eq-3

homematic

ccu2

ccu3

remote code execution

rce

exec.cgi

cve-2019-18937

nvd

script parser addon

7.5 High

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

9.7 High

AI Score

Confidence

High

0.013 Low

EPSS

Percentile

85.9%

JSON

eQ-3 Homematic CCU2 2.47.20 and CCU3 3.47.18 with the Script Parser AddOn through 1.8 installed allow Remote Code Execution by unauthenticated attackers with access to the web interface via the exec.cgi script, which executes TCL script content from an HTTP POST request.

Affected configurations

NVD

Node

scriptparser_projectscriptparserMatch1.8

AND

eq-3homematic_ccu2Match-

AND

eq-3homematic_ccu2_firmwareMatch2.47.20

Node

scriptparser_projectscriptparserMatch1.8

AND

eq-3homematic_ccu3Match-

AND

eq-3homematic_ccu3_firmwareMatch3.47.18

Node

scriptparser_projectscriptparserMatch1.7

AND

eq-3homematic_ccu3Match-

AND

eq-3homematic_ccu3_firmwareMatch3.47.18

Node

scriptparser_projectscriptparserMatch1.7

AND

eq-3homematic_ccu2Match-

AND

eq-3homematic_ccu2_firmwareMatch2.47.20

Node

scriptparser_projectscriptparserMatch1.6

AND

eq-3homematic_ccu2Match-

AND

eq-3homematic_ccu2_firmwareMatch2.47.20

Node

scriptparser_projectscriptparserMatch1.5

AND

eq-3homematic_ccu2Match-

AND

eq-3homematic_ccu2_firmwareMatch2.47.20

Node

scriptparser_projectscriptparserMatch1.4

AND

eq-3homematic_ccu2Match-

AND

eq-3homematic_ccu2_firmwareMatch2.47.20

Node

scriptparser_projectscriptparserMatch1.3

AND

eq-3homematic_ccu2Match-

AND

eq-3homematic_ccu2_firmwareMatch2.47.20

Node

scriptparser_projectscriptparserMatch1.3beta1

AND

eq-3homematic_ccu2Match-

AND

eq-3homematic_ccu2_firmwareMatch2.47.20

Node

scriptparser_projectscriptparserMatch1.2

AND

eq-3homematic_ccu2Match-

AND

eq-3homematic_ccu2_firmwareMatch2.47.20

Node

scriptparser_projectscriptparserMatch1.0

AND

eq-3homematic_ccu2Match-

AND

eq-3homematic_ccu2_firmwareMatch2.47.20

Node

scriptparser_projectscriptparserMatch1.6

AND

eq-3homematic_ccu3Match-

AND

eq-3homematic_ccu3_firmwareMatch3.47.18

Node

scriptparser_projectscriptparserMatch1.5

AND

eq-3homematic_ccu3Match-

AND

eq-3homematic_ccu3_firmwareMatch3.47.18

Node

scriptparser_projectscriptparserMatch1.4

AND

eq-3homematic_ccu3Match-

AND

eq-3homematic_ccu3_firmwareMatch3.47.18

Node

scriptparser_projectscriptparserMatch1.3

AND

eq-3homematic_ccu3Match-

AND

eq-3homematic_ccu3_firmwareMatch3.47.18

Node

scriptparser_projectscriptparserMatch1.3beta1

AND

eq-3homematic_ccu3Match-

AND

eq-3homematic_ccu3_firmwareMatch3.47.18

Node

scriptparser_projectscriptparserMatch1.2

AND

eq-3homematic_ccu3Match-

AND

eq-3homematic_ccu3_firmwareMatch3.47.18

Node

scriptparser_projectscriptparserMatch1.0

AND

eq-3homematic_ccu3Match-

AND

eq-3homematic_ccu3_firmwareMatch3.47.18

CPENameOperatorVersion
scriptparser_project:scriptparserscriptparser project scriptparsereq1.8
eq-3:homematic_ccu2_firmwareeq-3 homematic ccu2 firmwareeq2.47.20

CPE	Name	Operator	Version
scriptparser_project:scriptparser	scriptparser project scriptparser	eq	1.8
eq-3:homematic_ccu2_firmware	eq-3 homematic ccu2 firmware	eq	2.47.20

References

psytester.github.io/CVE-2019-18937/

7.5 High

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

9.7 High

AI Score

Confidence

High

0.013 Low

EPSS

Percentile

85.9%

JSON

Related for CVE-2019-18937

prion1 cvelist1 nvd1