CVE-2019-14986

CVE-2019-14986 affects eQ-3 Homematic CCU2/CCU3 with the CUxD AddOn prior to 2.3.0. Unauthenticated access to the web interface can perform administrative operations because features like File-Browser, Shell Command, and “Set root password” are exposed. The root cause is exposure of administrativ...

CVE-2019-14986

eQ-3 Homematic CCU2 and CCU3 with the CUxD AddOn before 2.3.0 installed allow administrative operations by unauthenticated attackers with access to the web interface, because features such as File-Browser and Shell Command as well as "Set root password" are exposed...

CVE-2019-14985

CVE-2019-14985 affects eQ-3 Homematic CCU2/CCU3 when the CUxD AddOn is installed. The web interface can access the CMD_EXEC virtual device type 28, enabling remote code execution by unauthenticated attackers. Several sources (NVD, Red Hat, CNVD, CVE listings) describe unauthenticated remote code ...

CVE-2019-14985

eQ-3 Homematic CCU2 and CCU3 with the CUxD AddOn installed allow Remote Code Execution by unauthenticated attackers with access to the web interface, because this interface can access the CMDEXEC virtual device type 28...

CVE-2019-14984

CVE-2019-14984 affects eQ-3 Homematic CCU2/CCU3 when the XML-API AddOn is installed up to version 1.2.0. The undocumented addons/xmlapi/exec.cgi script uses CMD_EXEC to execute TCL code from a POST request, enabling Remote Code Execution by unauthenticated attackers who have access to the web int...

CVE-2019-14984

eQ-3 Homematic CCU2 and CCU3 with the XML-API through 1.2.0 AddOn installed allow Remote Code Execution by unauthenticated attackers with access to the web interface, because the undocumented addons/xmlapi/exec.cgi script uses CMDEXEC to execute TCL code from a POST request...

eQ-3 Homematic CCU3 Input Validation Error Vulnerability

The eQ-3 Homematic CCU3 is a central control unit for smart home systems from eQ-3 Germany. An input validation error vulnerability exists in the 'Call' function of the ReGa core logic process in eQ-3 Homematic CCU3 3.47.15 and earlier versions, which can be exploited by an attacker to cause a...

CVE-2019-14474

eQ-3 Homematic CCU3 3.47.15 and prior has Improper Input Validation in function 'Call' of ReGa core logic process, resulting in the ability to start a Denial of Service. Due to Improper Authorization an attacker can obtain a session ID from CVE-2019-9583 or a valid guest/user/admin account can...

CVE-2019-14474

eQ-3 Homematic CCU3 3.47.15 and prior has Improper Input Validation in function 'Call' of ReGa core logic process, resulting in the ability to start a Denial of Service. Due to Improper Authorization an attacker can obtain a session ID from CVE-2019-9583 or a valid guest/user/admin account can...

CVE-2019-14474

CVE-2019-14474 affects eQ-3 Homematic CCU3 (3.47.15 and earlier) with an input validation flaw in the ReGa core logic Call() that allows a Denial of Service. The issue arises from improper authorization; an attacker can start the attack after obtaining a session ID (from CVE-2019-9583) or via a v...

CVE-2019-14474

eQ-3 Homematic CCU3 3.47.15 and prior has Improper Input Validation in function 'Call' of ReGa core logic process, resulting in the ability to start a Denial of Service. Due to Improper Authorization an attacker can obtain a session ID from CVE-2019-9583 or a valid guest/user/admin account can...

CVE-2019-14473

eQ-3 Homematic CCU2 and CCU3 use session IDs for authentication but lack authorization checks. Consequently, a valid guest level or user level account can create a new admin level account, read the service messages, clear the system protocol or modify/delete internal programs, etc. pp...

CVE-2019-14473

eQ-3 Homematic CCU2 and CCU3 use session IDs for authentication but lack authorization checks. Consequently, a valid guest level or user level account can create a new admin level account, read the service messages, clear the system protocol or modify/delete internal programs, etc. pp...

Authorization

eQ-3 Homematic CCU2 and CCU3 use session IDs for authentication but lack authorization checks. Consequently, a valid guest level or user level account can create a new admin level account, read the service messages, clear the system protocol or modify/delete internal programs, etc. pp...

CVE-2019-14473

eQ-3 Homematic CCU2 and CCU3 use session IDs for authentication but lack authorization checks. Consequently, a valid guest level or user level account can create a new admin level account, read the service messages, clear the system protocol or modify/delete internal programs, etc. pp...

CVE-2019-14473

CVE-2019-14473 affects the eQ-3 Homematic CCU2 and CCU3. The issue arises because authentication uses session IDs but there are no proper authorization checks, allowing a valid guest or user account to escalate to admin-level access. This can enable creating a new admin account, reading service m...

CVE-2019-14475

eQ-3 Homematic CCU2 2.47.15 and prior and CCU3 3.47.15 and prior use session IDs for authentication but lack authorization checks. An attacker can obtain a session ID from CVE-2019-9583, resulting in the ability to read the service messages, clear the system protocol, create a new user in the...

CVE-2019-14475

eQ-3 Homematic CCU2 2.47.15 and prior and CCU3 3.47.15 and prior use session IDs for authentication but lack authorization checks. An attacker can obtain a session ID from CVE-2019-9583, resulting in the ability to read the service messages, clear the system protocol, create a new user in the...

Authorization

eQ-3 Homematic CCU2 2.47.15 and prior and CCU3 3.47.15 and prior use session IDs for authentication but lack authorization checks. An attacker can obtain a session ID from CVE-2019-9583, resulting in the ability to read the service messages, clear the system protocol, create a new user in the...

CVE-2019-14475

eQ-3 Homematic CCU2 2.47.15 and prior and CCU3 3.47.15 and prior use session IDs for authentication but lack authorization checks. An attacker can obtain a session ID from CVE-2019-9583, resulting in the ability to read the service messages, clear the system protocol, create a new user in the...