CVE-2019-9582

eQ-3 Homematic CCU2 outdated base software packages allows Denial of Service. CCU2 affected versions: 2.35.16, 2.41.5, 2.41.8, 2.41.9, 2.45.6, 2.45.7, 2.47.10, 2.47.12, 2.47.15...

CVE-2019-9582

CVE-2019-9582 affects eQ-3 Homematic CCU2 via outdated base software packages, enabling Denial of Service. Affected CCU2 versions: 2.35.16, 2.41.5, 2.41.8, 2.41.9, 2.45.6, 2.45.7, 2.47.10, 2.47.12, 2.47.15. The provided connected documents state the vulnerability vector as a DoS condition due to ...

CVE-2019-9583

The CVE-2019-9583 issue affects eQ-3 Homematic CCU2 and CCU3: attackers can obtain session IDs without authentication, enabling a Denial of Service and acting as a starting point for further attacks. Affected CCU2 versions include 2.35.16, 2.41.5/2.41.8/2.41.9, 2.45.6/2.45.7, 2.47.10/2.47.12/2.47...

CVE-2019-9583

eQ-3 Homematic CCU2 and CCU3 obtain session IDs without login. This allows a Denial of Service and is a starting point for other attacks. Affected versions for CCU2: 2.35.16, 2.41.5, 2.41.8, 2.41.9, 2.45.6, 2.45.7, 2.47.10, 2.47.12, 2.47.15. Affected versions for CCU3: 3.41.11, 3.43.16, 3.45.5,...

CVE-2019-14984

eQ-3 Homematic CCU2 and CCU3 with the XML-API through 1.2.0 AddOn installed allow Remote Code Execution by unauthenticated attackers with access to the web interface, because the undocumented addons/xmlapi/exec.cgi script uses CMDEXEC to execute TCL code from a POST request...

CVE-2019-14985

eQ-3 Homematic CCU2 and CCU3 with the CUxD AddOn installed allow Remote Code Execution by unauthenticated attackers with access to the web interface, because this interface can access the CMDEXEC virtual device type 28...

CVE-2019-14986

eQ-3 Homematic CCU2 and CCU3 with the CUxD AddOn before 2.3.0 installed allow administrative operations by unauthenticated attackers with access to the web interface, because features such as File-Browser and Shell Command as well as "Set root password" are exposed...

Design/Logic Flaw

eQ-3 Homematic CCU2 and CCU3 with the XML-API through 1.2.0 AddOn installed allow Remote Code Execution by unauthenticated attackers with access to the web interface, because the undocumented addons/xmlapi/exec.cgi script uses CMDEXEC to execute TCL code from a POST request...

Design/Logic Flaw

eQ-3 Homematic CCU2 and CCU3 with the CUxD AddOn installed allow Remote Code Execution by unauthenticated attackers with access to the web interface, because this interface can access the CMDEXEC virtual device type 28...

CVE-2019-14986

CVE-2019-14986 affects eQ-3 Homematic CCU2/CCU3 with the CUxD AddOn prior to 2.3.0. Unauthenticated access to the web interface can perform administrative operations because features like File-Browser, Shell Command, and “Set root password” are exposed. The root cause is exposure of administrativ...

CVE-2019-14986

eQ-3 Homematic CCU2 and CCU3 with the CUxD AddOn before 2.3.0 installed allow administrative operations by unauthenticated attackers with access to the web interface, because features such as File-Browser and Shell Command as well as "Set root password" are exposed...

CVE-2019-14985

CVE-2019-14985 affects eQ-3 Homematic CCU2/CCU3 when the CUxD AddOn is installed. The web interface can access the CMD_EXEC virtual device type 28, enabling remote code execution by unauthenticated attackers. Several sources (NVD, Red Hat, CNVD, CVE listings) describe unauthenticated remote code ...

CVE-2019-14985

eQ-3 Homematic CCU2 and CCU3 with the CUxD AddOn installed allow Remote Code Execution by unauthenticated attackers with access to the web interface, because this interface can access the CMDEXEC virtual device type 28...

CVE-2019-14984

eQ-3 Homematic CCU2 and CCU3 with the XML-API through 1.2.0 AddOn installed allow Remote Code Execution by unauthenticated attackers with access to the web interface, because the undocumented addons/xmlapi/exec.cgi script uses CMDEXEC to execute TCL code from a POST request...

CVE-2019-14984

CVE-2019-14984 affects eQ-3 Homematic CCU2/CCU3 when the XML-API AddOn is installed up to version 1.2.0. The undocumented addons/xmlapi/exec.cgi script uses CMD_EXEC to execute TCL code from a POST request, enabling Remote Code Execution by unauthenticated attackers who have access to the web int...

CVE-2019-14474

eQ-3 Homematic CCU3 3.47.15 and prior has Improper Input Validation in function 'Call' of ReGa core logic process, resulting in the ability to start a Denial of Service. Due to Improper Authorization an attacker can obtain a session ID from CVE-2019-9583 or a valid guest/user/admin account can...

CVE-2019-14474

eQ-3 Homematic CCU3 3.47.15 and prior has Improper Input Validation in function 'Call' of ReGa core logic process, resulting in the ability to start a Denial of Service. Due to Improper Authorization an attacker can obtain a session ID from CVE-2019-9583 or a valid guest/user/admin account can...

CVE-2019-14474

CVE-2019-14474 affects eQ-3 Homematic CCU3 (3.47.15 and earlier) with an input validation flaw in the ReGa core logic Call() that allows a Denial of Service. The issue arises from improper authorization; an attacker can start the attack after obtaining a session ID (from CVE-2019-9583) or via a v...

CVE-2019-14473

eQ-3 Homematic CCU2 and CCU3 use session IDs for authentication but lack authorization checks. Consequently, a valid guest level or user level account can create a new admin level account, read the service messages, clear the system protocol or modify/delete internal programs, etc. pp...

CVE-2019-14473

CVE-2019-14473 affects the eQ-3 Homematic CCU2 and CCU3. The issue arises because authentication uses session IDs but there are no proper authorization checks, allowing a valid guest or user account to escalate to admin-level access. This can enable creating a new admin account, reading service m...