Design/Logic Flaw

2019-08-1320:15:00

PRIOn knowledge base

www.prio-n.com

9.7 High

AI Score

Confidence

High

0.009 Low

EPSS

Percentile

82.9%

JSON

eQ-3 Homematic CCU2 and CCU3 with the CUxD AddOn installed allow Remote Code Execution by unauthenticated attackers with access to the web interface, because this interface can access the CMD_EXEC virtual device type 28.

CPENameOperatorVersion
homematic_ccu2_firmwareeq2.35.16
homematic_ccu2_firmwareeq2.41.5
homematic_ccu2_firmwareeq2.41.8
homematic_ccu2_firmwareeq2.41.9
homematic_ccu2_firmwareeq2.45.6
homematic_ccu2_firmwareeq2.45.7
homematic_ccu2_firmwareeq2.47.10
homematic_ccu2_firmwareeq2.47.12
homematic_ccu2_firmwareeq2.47.15
homematic_ccu3_firmwareeq3.41.11

Name	Operator	Version
homematic_ccu2_firmware	eq	2.35.16
homematic_ccu2_firmware	eq	2.41.5
homematic_ccu2_firmware	eq	2.41.8
homematic_ccu2_firmware	eq	2.41.9
homematic_ccu2_firmware	eq	2.45.6
homematic_ccu2_firmware	eq	2.45.7
homematic_ccu2_firmware	eq	2.47.10
homematic_ccu2_firmware	eq	2.47.12
homematic_ccu2_firmware	eq	2.47.15
homematic_ccu3_firmware	eq	3.41.11

Rows per page:

1-10 of 151

References

psytester.github.io/CVE-2019-14985/