PT-2019-11584 · Eq 3 · Eq-3 Homematic Ccu3+1
Publicado
2019-07-10
·
Atualizado
2020-08-24
·
CVE-2019-10121
CVSS v3.1
9.8
Crítica
| Vetor | AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions:
eQ-3 HomeMatic CCU2 versions prior to 2.41.8
eQ-3 HomeMatic CCU3 versions prior to 3.43.15
Description:
The issue allows an attacker to bypass authentication and automatically log in as an admin by exploiting the lack of authorization checks in the session ID-based authentication mechanism. This can be achieved by obtaining a session ID through the user authentication dialogue.
Recommendations:
For eQ-3 HomeMatic CCU2 versions prior to 2.41.8, update to version 2.41.8 or later to resolve the issue.
For eQ-3 HomeMatic CCU3 versions prior to 3.43.15, update to version 3.43.15 or later to resolve the issue.
Correção
Missing Authentication
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Eq-3 Homematic Ccu2
Eq-3 Homematic Ccu3