PT-2019-13719 · Eq 3 · Eq-3 Homematic Ccu2+1

Psytester · Publicado 2019-08-05 · Atualizado 2020-08-24 · CVE-2019-14475

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions eQ-3 Homematic CCU2 versions 2.47.15 and prior eQ-3 Homematic CCU3 versions 3.47.15 and prior

Description The issue concerns a lack of authorization checks in the authentication process, which relies on session IDs. An attacker can exploit this to gain unauthorized access to system functionalities, including reading service messages, clearing the system protocol, creating new users, or modifying and deleting internal programs.

Recommendations For eQ-3 Homematic CCU2 versions 2.47.15 and prior, update to a version that includes proper authorization checks. For eQ-3 Homematic CCU3 versions 3.47.15 and prior, update to a version that includes proper authorization checks. As a temporary workaround, consider restricting access to sensitive system functionalities until a patch is available.

Exploit

Correção

Missing Authorization

Enumeração de Fraquezas

CWE-862

Identificadores relacionados

CVE-2019-14475

Produtos afetados

Eq-3 Homematic Ccu2

Eq-3 Homematic Ccu3

Referências · 3

• 🔥 https://psytester.github.io/CVE-2019-14475 · Exploit
• https://osv.dev/vulnerability/CVE-2019-14475 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2019-14475 · Nota de Segurança