Code injection

eQ-3 Homematic CCU2 and CCU3 obtain session IDs without login. This allows a Denial of Service and is a starting point for other attacks. Affected versions for CCU2: 2.35.16, 2.41.5, 2.41.8, 2.41.9, 2.45.6, 2.45.7, 2.47.10, 2.47.12, 2.47.15. Affected versions for CCU3: 3.41.11, 3.43.16, 3.45.5,...

CVE-2019-9585

eQ-3 Homematic CCU2 prior to 2.47.10 and CCU3 prior to 3.47.10 JSON API has Improper Access Control for Interface.Metadata related operations, resulting in the ability to read, set and deletion of Metadata...

CVE-2019-9585

CVE-2019-9585 affects eQ-3 Homematic CCU2 (before 2.47.10) and CCU3 (before 3.47.10). The JSON API has improper access control, enabling metadata read, set, and delete operations via the interface. ROOT CAUSE: insufficient access restrictions on the JSON API. IMPACT: potential disclosure and modi...

CVE-2019-9584

eQ-3 Homematic AddOn 'CloudMatic' on CCU2 and CCU3 allows uncontrolled admin access, resulting in the ability to obtain VPN profile details, shutting down the VPN service and to delete the VPN service configuration. This is related to improper access control for all /addons/mh/ pages...

CVE-2019-9584

CVE-2019-9584 involves the eQ-3 Homematic AddOn “CloudMatic” running on CCU2/CCU3. The issue is improper access control on all /addons/mh/ pages, enabling uncontrolled admin access. This allows attackers to obtain VPN profile details, shut down the VPN service, and delete the VPN service configur...

CVE-2019-9582

eQ-3 Homematic CCU2 outdated base software packages allows Denial of Service. CCU2 affected versions: 2.35.16, 2.41.5, 2.41.8, 2.41.9, 2.45.6, 2.45.7, 2.47.10, 2.47.12, 2.47.15...

CVE-2019-9582

CVE-2019-9582 affects eQ-3 Homematic CCU2 via outdated base software packages, enabling Denial of Service. Affected CCU2 versions: 2.35.16, 2.41.5, 2.41.8, 2.41.9, 2.45.6, 2.45.7, 2.47.10, 2.47.12, 2.47.15. The provided connected documents state the vulnerability vector as a DoS condition due to ...

CVE-2019-9583

eQ-3 Homematic CCU2 and CCU3 obtain session IDs without login. This allows a Denial of Service and is a starting point for other attacks. Affected versions for CCU2: 2.35.16, 2.41.5, 2.41.8, 2.41.9, 2.45.6, 2.45.7, 2.47.10, 2.47.12, 2.47.15. Affected versions for CCU3: 3.41.11, 3.43.16, 3.45.5,...

CVE-2019-9583

The CVE-2019-9583 issue affects eQ-3 Homematic CCU2 and CCU3: attackers can obtain session IDs without authentication, enabling a Denial of Service and acting as a starting point for further attacks. Affected CCU2 versions include 2.35.16, 2.41.5/2.41.8/2.41.9, 2.45.6/2.45.7, 2.47.10/2.47.12/2.47...

eQ-3 Homematic CCU2 and CCU3 Input Validation Error Vulnerability

The eQ-3 Homematic CCU3 and eQ-3 HomeMatic CCU2 are both central control units for a smart home system from eQ-3 Germany. An input validation error vulnerability exists in eQ-3 Homematic CCU2 and CCU3, which can be exploited by an unauthenticated attacker to achieve remote code execution...

eQ-3 HomeMatic CCU2 and eQ-3 Homematic CCU3 Access Control Error Vulnerabilities

The eQ-3 Homematic CCU3 and the eQ-3 HomeMatic CCU2 are both central control units for a smart home system from eQ-3 Germany. An access control error vulnerability exists in the JSON API in the eQ-3 Homematic CCU2 version prior to 2.47.10 and the eQ-3 Homematic CCU3 version prior to 3.47.10, whic...

eQ-3 Homematic CCU2 and CCU3 Command Injection Vulnerabilities

The eQ-3 Homematic CCU3 and eQ-3 HomeMatic CCU2 are both central control units for a smart home system from eQ-3 Germany. A command injection vulnerability exists in the eQ-3 Homematic CCU2 and CCU3, which can be exploited by an attacker to execute an illegal command if a networked system or...

PT-2019-19725

Name of the Vulnerable Software and Affected Versions eQ-3 Homematic CCU2 versions 2.35.16, 2.41.5, 2.41.8, 2.41.9, 2.45.6, 2.45.7, 2.47.10, 2.47.12, 2.47.15 eQ-3 Homematic CCU3 versions 3.41.11, 3.43.16, 3.45.5, 3.45.7, 3.47.10, 3.47.15 Description The issue allows an attacker to obtain session...

PT-2019-19724

Name of the Vulnerable Software and Affected Versions eQ-3 Homematic CCU2 versions 2.35.16 through 2.47.15 Description The issue allows for Denial of Service due to outdated base software packages. Recommendations For version 2.35.16, update to a version newer than 2.35.16 to resolve the issue. F...

PT-2019-19727

Name of the Vulnerable Software and Affected Versions eQ-3 Homematic CCU2 versions prior to 2.47.10 eQ-3 Homematic CCU3 versions prior to 3.47.10 Description The issue is related to Improper Access Control in the JSON API for Interface.Metadata related operations. This allows unauthorized access ...

PT-2019-19726

Name of the Vulnerable Software and Affected Versions eQ-3 Homematic AddOn 'CloudMatic' on CCU2 and CCU3 Description The issue allows uncontrolled admin access, enabling attackers to obtain VPN profile details, shut down the VPN service, and delete the VPN service configuration. This is due to...

PT-2019-13088

Name of the Vulnerable Software and Affected Versions eQ-3 Homematic CCU3 AddOn 'Mediola NEO Server for Homematic CCU3' versions prior to 2.4.5 Description The issue is related to improper access control for addons configuration pages and a missing check in rc.d/97NeoServer, allowing uncontrolled...

CVE-2019-13030: Direct Request

eQ-3 Homematic CCU3 AddOn 'Mediola NEO Server for Homematic CCU3' prior to 2.4.5 allows uncontrolled admin access to start or stop the Node.js process, resulting in the ability to obtain mediola configuration details. This is related to improper access control for addons configuration pages and a...

CVE-2019-9584: Direct Request

eQ-3 Homematic AddOn 'CloudMatic' on CCU2 and CCU3 allows uncontrolled admin access, resulting in the ability to obtain VPN profile details, shutting down the VPN service and to delete the VPN service configuration. This is related to improper access control for all /addons/mh/ pages...

CVE-2019-9585: Missing Authentication for Critical Function

eQ-3 Homematic CCU2 prior to 2.47.10 and CCU3 prior to 3.47.10 JSON API has Improper Access Control for Interface.Metadata related operations, resulting in the ability to read, set and deletion of Metadata...