Design/Logic Flaw

2019-08-1320:15:00

PRIOn knowledge base

www.prio-n.com

8.2 High

AI Score

Confidence

High

0.004 Low

EPSS

Percentile

74.8%

JSON

eQ-3 Homematic CCU2 and CCU3 with the CUxD AddOn before 2.3.0 installed allow administrative operations by unauthenticated attackers with access to the web interface, because features such as File-Browser and Shell Command (as well as “Set root password”) are exposed.

CPENameOperatorVersion
homematic_ccu2_firmwarelt2.3.0
homematic_ccu3_firmwarelt2.3.0

CPE	Name	Operator	Version
	homematic_ccu2_firmware	lt	2.3.0
	homematic_ccu3_firmware	lt	2.3.0

References

psytester.github.io/CVE-2019-14986/