PT-2019-11582 · Eq 3 · Eq-3 Homematic Ccu3+1

Publicado

2019-07-10

·

Atualizado

2020-08-24

·

CVE-2019-10119

CVSS v3.1

9.8

Crítica

VetorAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions: eQ-3 HomeMatic CCU2 versions prior to 2.41.8 eQ-3 HomeMatic CCU3 versions prior to 3.43.16
Description: The issue allows an attacker to bypass authentication due to the lack of authorization checks when using session IDs for authentication. An attacker can obtain a session ID through an invalid login attempt to the RemoteApi account, which leads to automatic login as an admin.
Recommendations: For eQ-3 HomeMatic CCU2 versions prior to 2.41.8, update to version 2.41.8 or later. For eQ-3 HomeMatic CCU3 versions prior to 3.43.16, update to version 3.43.16 or later.

Correção

Missing Authentication

Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
dbugs@ptsecurity.com

Enumeração de Fraquezas

CWE-306

Identificadores relacionados

CVE-2019-10119

Produtos afetados

Eq-3 Homematic Ccu2
Eq-3 Homematic Ccu3