CVE-2018-7296

2018-02-2219:00:00

mitre

www.cve.org

6.5 Medium

AI Score

Confidence

High

0.002 Low

EPSS

Percentile

55.3%

JSON

Directory Traversal / Arbitrary File Read in User.getLanguage method in eQ-3 AG Homematic CCU2 2.29.2 and earlier allows remote attackers to read the first line of an arbitrary file on the CCU2’s filesystem. This vulnerability can be exploited by unauthenticated attackers with access to the web interface.

References

atomic111.github.io/article/homematic-ccu2-fileread