CVE-2019-10120: Session Fixation

On eQ-3 HomeMatic CCU2 devices before 2.41.8 and CCU3 devices before 3.43.16, automatic login configuration aka setAutoLogin can be achieved by continuing to use a session ID after a logout, aka HMCCU-154...

CVE-2019-10119: Missing Authentication for Critical Function

eQ-3 HomeMatic CCU2 devices before 2.41.8 and CCU3 devices before 3.43.16 use session IDs for authentication but lack authorization checks. An attacker can obtain a session ID via an invalid login attempt to the RemoteApi account, aka HMCCU-154. This leads to automatic login as admin...

PT-2019-11583

Name of the Vulnerable Software and Affected Versions: eQ-3 HomeMatic CCU2 versions prior to 2.41.8 eQ-3 HomeMatic CCU3 versions prior to 3.43.16 Description: The issue allows automatic login configuration to be achieved by continuing to use a session ID after a logout. Recommendations: For eQ-3...

PT-2019-11582

Name of the Vulnerable Software and Affected Versions: eQ-3 HomeMatic CCU2 versions prior to 2.41.8 eQ-3 HomeMatic CCU3 versions prior to 3.43.16 Description: The issue allows an attacker to bypass authentication due to the lack of authorization checks when using session IDs for authentication. A...

PT-2019-11584

Name of the Vulnerable Software and Affected Versions: eQ-3 HomeMatic CCU2 versions prior to 2.41.8 eQ-3 HomeMatic CCU3 versions prior to 3.43.15 Description: The issue allows an attacker to bypass authentication and automatically log in as an admin by exploiting the lack of authorization checks ...

PT-2019-11585

Name of the Vulnerable Software and Affected Versions: eQ-3 HomeMatic CCU2 versions prior to 2.41.9 eQ-3 HomeMatic CCU3 versions prior to 3.43.16 Description: The issue is related to buffer overflows in the ReGa ise GmbH HTTP-Server 2.0 component. This may lead to remote code execution...

CVE-2019-9726

Directory Traversal / Arbitrary File Read in eQ-3 AG Homematic CCU3 3.43.15 and earlier allows remote attackers to read arbitrary files of the device's filesystem. This vulnerability can be exploited by unauthenticated attackers with access to the web interface...

Design/Logic Flaw

Unauthenticated password hash disclosure in the User.getUserPWD method in eQ-3 AG Homematic CCU3 3.43.15 and earlier allows remote attackers to retrieve the GUI password hashes of GUI users. This vulnerability can be exploited by unauthenticated attackers with access to the web interface...

Directory traversal

Directory Traversal / Arbitrary File Read in eQ-3 AG Homematic CCU3 3.43.15 and earlier allows remote attackers to read arbitrary files of the device's filesystem. This vulnerability can be exploited by unauthenticated attackers with access to the web interface...

CVE-2019-9727

Unauthenticated password hash disclosure in the User.getUserPWD method in eQ-3 AG Homematic CCU3 3.43.15 and earlier allows remote attackers to retrieve the GUI password hashes of GUI users. This vulnerability can be exploited by unauthenticated attackers with access to the web interface...

CVE-2019-9727

CVE-2019-9727 affects eQ-3 AG Homematic CCU3 (versions 3.43.15 and earlier). The flaw is an unauthenticated password hash disclosure in the GUI, exposed via User.getUserPWD, allowing remote attackers with access to the web interface to retrieve GUI password hashes. The vulnerability is network-ex...

CVE-2019-9726

Directory Traversal / Arbitrary File Read in eQ-3 AG Homematic CCU3 3.43.15 and earlier allows remote attackers to read arbitrary files of the device's filesystem. This vulnerability can be exploited by unauthenticated attackers with access to the web interface...

CVE-2019-9726

The connected Nuclei template confirms CVE-2019-9726 affects eQ-3 AG Homematic CCU3 firmware 3.43.15 and earlier, enabling Local File Inclusion (directory traversal) by unauthenticated attackers with access to the web interface to read arbitrary files from the device filesystem. Root cause is imp...

CVE-2019-9727: Missing Authentication for Critical Function

Unauthenticated password hash disclosure in the User.getUserPWD method in eQ-3 AG Homematic CCU3 3.43.15 and earlier allows remote attackers to retrieve the GUI password hashes of GUI users. This vulnerability can be exploited by unauthenticated attackers with access to the web interface...

PT-2019-19824

Name of the Vulnerable Software and Affected Versions eQ-3 AG Homematic CCU3 versions 3.43.15 and earlier Description The issue allows remote attackers to read arbitrary files of the device's filesystem through Directory Traversal or Arbitrary File Read. This can be exploited by unauthenticated...

CVE-2019-9726: Improper Limitation of a Pathname to a Restricted Directory

Directory Traversal / Arbitrary File Read in eQ-3 AG Homematic CCU3 3.43.15 and earlier allows remote attackers to read arbitrary files of the device's filesystem. This vulnerability can be exploited by unauthenticated attackers with access to the web interface...

PT-2019-19825

Name of the Vulnerable Software and Affected Versions eQ-3 AG Homematic CCU3 versions 3.43.15 and earlier Description The issue allows unauthenticated remote attackers to disclose password hashes of GUI users through the User.getUserPWD method. This can be exploited by attackers with access to th...

CVE-2018-7301

eQ-3 AG HomeMatic CCU2 2.29.22 devices have an open XML-RPC port without authentication. This can be exploited by sending arbitrary XML-RPC requests to control the attached BidCos devices...

CVE-2018-7299

Remote Code Execution in the addon installation process in eQ-3 AG Homematic CCU2 2.29.2 and earlier allows authenticated attackers to create or overwrite arbitrary files or install malicious software on the device...

CVE-2018-7300

Directory Traversal / Arbitrary File Write / Remote Code Execution in the User.setLanguage method in eQ-3 AG Homematic CCU2 2.29.2 and earlier allows remote attackers to write arbitrary files to the device's filesystem. This vulnerability can be exploited by unauthenticated attackers with access ...