Directory traversal

2018-02-2219:29:00

PRIOn knowledge base

www.prio-n.com

5.5 Medium

AI Score

Confidence

High

0.002 Low

EPSS

Percentile

55.3%

JSON

Directory Traversal / Arbitrary File Read in User.getLanguage method in eQ-3 AG Homematic CCU2 2.29.2 and earlier allows remote attackers to read the first line of an arbitrary file on the CCU2’s filesystem. This vulnerability can be exploited by unauthenticated attackers with access to the web interface.

CPENameOperatorVersion
homematic_central_control_unit_ccu2_firmwarele2.29.22

CPE	Name	Operator	Version
	homematic_central_control_unit_ccu2_firmware	le	2.29.22

References

atomic111.github.io/article/homematic-ccu2-fileread