PT-2018-18007 · Eq 3 Ag · Homematic Ccu2

Gregor Kopf + 1 · Publicado 2018-02-22 · Atualizado 2019-10-03 · CVE-2018-7299

Positive Technologies (AI Summary)

CVSS v3.1

8.0

Alta

Vetor base

AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions eQ-3 AG Homematic CCU2 versions 2.29.2 and earlier

Description The issue allows authenticated attackers to perform Remote Code Execution in the addon installation process. This enables them to create or overwrite arbitrary files or install malicious software on the device.

Recommendations For versions 2.29.2 and earlier, update to a version later than 2.29.2 to resolve the issue.

Correção

Identificadores relacionados

CVE-2018-7299

Produtos afetados

Homematic Ccu2

Referências · 3

• https://nvd.nist.gov/vuln/detail/CVE-2018-7299 · Nota de Segurança
• http://atomic111.github.io/article/homematic-ccu2-untrusted_addon · Nota
• https://osv.dev/vulnerability/CVE-2018-7299 · Aviso do Fabricante