PT-2019-14435 · Eq 3 · Eq-3 Homematic Ccu3

Joshua Lehr · Publicado 2019-10-17 · Atualizado 2019-10-22 · CVE-2019-15849

Positive Technologies (AI Summary)

CVSS v3.1

7.3

Alta

Vetor base

AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions eQ-3 HomeMatic CCU3 firmware version 3.41.11

Description The issue allows session fixation, where an attacker can create session IDs and send them to the victim. After the victim logs in to the session, the attacker can use that session. This could lead to the creation of SSH logins after a valid session, potentially compromising the system.

Recommendations For eQ-3 HomeMatic CCU3 firmware version 3.41.11, consider disabling SSH logins until a patch is available to prevent potential system compromise. As a temporary workaround, restrict access to sensitive sessions to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Session Fixation

Enumeração de Fraquezas

CWE-384

Identificadores relacionados

CVE-2019-15849

Produtos afetados

Eq-3 Homematic Ccu3

Referências · 4

• 🔥 https://noskill1337.github.io/homematic-ccu3-session-fixation · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2019-15849 · Nota de Segurança
• https://eq-3.com/products/homematic.html · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2019-15849 · Aviso do Fabricante