Cross site request forgery (csrf)

2019-10-1714:15:00

PRIOn knowledge base

www.prio-n.com

6.1 Medium

AI Score

Confidence

High

0.004 Low

EPSS

Percentile

72.1%

JSON

A Local File Inclusion (LFI) issue in the addon CUx-Daemon 1.11a of the eQ-3 Homematic CCU-Firmware 2.35.16 until 2.45.6 allows remote authenticated attackers to read sensitive files via a simple HTTP Request.

CPENameOperatorVersion
ccu2_firmwarege2.35.16
ccu2_firmwarele2.45.6
cux-daemoneq>= 1.11a AND <= 2.2.0

Name	Operator	Version
ccu2_firmware	ge	2.35.16
ccu2_firmware	le	2.45.6
cux-daemon	eq	>= 1.11a AND <= 2.2.0

References

noskill1337.github.io/homematic-with-cux-daemon-local-file-inclusion

www.eq-3.com/products/homematic.html