CVE-2019-18938: Missing Authentication for Critical Function

eQ-3 Homematic CCU2 2.47.20 and CCU3 3.47.18 with the E-Mail AddOn through 1.6.8.c installed allow Remote Code Execution by unauthenticated attackers with access to the web interface via the save.cgi script for payload upload and the testtcl.cgi script for its execution...

CVE-2019-18939: Missing Authentication for Critical Function

eQ-3 Homematic CCU2 2.47.20 and CCU3 3.47.18 with the HM-Print AddOn through 1.2a installed allow Remote Code Execution by unauthenticated attackers with access to the web interface via the exec.cgi and exec1.cgi scripts, which execute TCL script content from an HTTP POST request...

eQ-3 Homematic CCU3 Session Fixation Vulnerability

The eQ-3 Homematic CCU3 is a central control unit for smart home systems from eQ-3 Germany. A session fixation vulnerability exists in the eQ-3 Homematic CCU3 using firmware version 3.41.11, which can be exploited by an attacker to log in and control the system by creating a session ID and sendin...

eQ-3 Homematic CCU3 Remote Code Execution Vulnerability (CNVD-2020-14281)

The eQ-3 Homematic CCU3 is a central control unit for smart home systems from eQ-3 Germany. A remote code execution vulnerability exists in the ReGa.runScript method in the eQ-3 Homematic CCU3 using firmware version 3.41.11, which can be exploited by an attacker to execute code and compromise the...

CVE-2019-14424

A Local File Inclusion LFI issue in the addon CUx-Daemon 1.11a of the eQ-3 Homematic CCU-Firmware 2.35.16 until 2.45.6 allows remote authenticated attackers to read sensitive files via a simple HTTP Request...

CVE-2019-15849

eQ-3 HomeMatic CCU3 firmware 3.41.11 allows session fixation. An attacker can create session IDs and send them to the victim. After the victim logs in to the session, the attacker can use that session. The attacker could create SSH logins after a valid session and easily compromise the system...

CVE-2019-14423

A Remote Code Execution RCE issue in the addon CUx-Daemon 1.11a of the eQ-3 Homematic CCU-Firmware 2.35.16 until 2.45.6 allows remote authenticated attackers to execute system commands as root remotely via a simple HTTP request...

CVE-2019-14424

A Local File Inclusion LFI issue in the addon CUx-Daemon 1.11a of the eQ-3 Homematic CCU-Firmware 2.35.16 until 2.45.6 allows remote authenticated attackers to read sensitive files via a simple HTTP Request...

CVE-2019-15850

eQ-3 HomeMatic CCU3 firmware version 3.41.11 allows Remote Code Execution in the ReGa.runScript method. An authenticated attacker can easily execute code and compromise the system...

CVE-2019-14423

A Remote Code Execution RCE issue in the addon CUx-Daemon 1.11a of the eQ-3 Homematic CCU-Firmware 2.35.16 until 2.45.6 allows remote authenticated attackers to execute system commands as root remotely via a simple HTTP request...

CVE-2019-15849

eQ-3 HomeMatic CCU3 firmware 3.41.11 allows session fixation. An attacker can create session IDs and send them to the victim. After the victim logs in to the session, the attacker can use that session. The attacker could create SSH logins after a valid session and easily compromise the system...

CVE-2019-15850

eQ-3 HomeMatic CCU3 firmware version 3.41.11 allows Remote Code Execution in the ReGa.runScript method. An authenticated attacker can easily execute code and compromise the system...

Cross site request forgery (csrf)

A Local File Inclusion LFI issue in the addon CUx-Daemon 1.11a of the eQ-3 Homematic CCU-Firmware 2.35.16 until 2.45.6 allows remote authenticated attackers to read sensitive files via a simple HTTP Request...

Remote code execution

eQ-3 HomeMatic CCU3 firmware version 3.41.11 allows Remote Code Execution in the ReGa.runScript method. An authenticated attacker can easily execute code and compromise the system...

Cross site request forgery (csrf)

A Remote Code Execution RCE issue in the addon CUx-Daemon 1.11a of the eQ-3 Homematic CCU-Firmware 2.35.16 until 2.45.6 allows remote authenticated attackers to execute system commands as root remotely via a simple HTTP request...

Session fixation

eQ-3 HomeMatic CCU3 firmware 3.41.11 allows session fixation. An attacker can create session IDs and send them to the victim. After the victim logs in to the session, the attacker can use that session. The attacker could create SSH logins after a valid session and easily compromise the system...

CVE-2019-15850

The CVE-2019-15850 entry concerns eQ-3 Homematic CCU3 firmware 3.41.11 with a remote code execution flaw in the ReGa.runScript method. An authenticated attacker can execute code and compromise the system, as indicated by multiple sources (NVD, RH, CNVD, CNVD-CNVD). The affected product is the eQ-...

CVE-2019-15850

eQ-3 HomeMatic CCU3 firmware version 3.41.11 allows Remote Code Execution in the ReGa.runScript method. An authenticated attacker can easily execute code and compromise the system...

CVE-2019-15849

eQ-3 HomeMatic CCU3 firmware 3.41.11 allows session fixation. An attacker can create session IDs and send them to the victim. After the victim logs in to the session, the attacker can use that session. The attacker could create SSH logins after a valid session and easily compromise the system...

CVE-2019-15849

CVE-2019-15849 affects eQ-3 HomeMatic CCU3 firmware version 3.41.11. The root issue is a session fixation vulnerability that lets an attacker create session IDs and deliver them to a victim; after the victim authenticates to that session, the attacker can reuse it to access the system and, as des...