PT-2019-13718 · Eq 3 · Homematic Ccu3

Psytester · Publicado 2019-08-07 · Atualizado 2019-08-16 · CVE-2019-14474

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions eQ-3 Homematic CCU3 versions 3.47.15 and prior

Description The issue is related to Improper Input Validation in the Call() function of the ReGa core logic process. This can lead to a Denial of Service. Additionally, due to Improper Authorization, an attacker can exploit this issue by obtaining a session ID or using a valid guest, user, or admin account.

Recommendations For versions 3.47.15 and prior, consider disabling the Call() function of the ReGa core logic process as a temporary workaround to prevent potential Denial of Service attacks. Restrict access to valid guest, user, and admin accounts to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this issue.

Exploit

Correção

RCE

Enumeração de Fraquezas

CWE-20

Identificadores relacionados

CVE-2019-14474

Produtos afetados

Homematic Ccu3

Referências · 3

• 🔥 https://psytester.github.io/CVE-2019-14474 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2019-14474 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2019-14474 · Aviso do Fabricante