PT-2019-15726 · Eq 3 · Eq-3 Homematic Ccu3+2

Psytester · Publicado 2019-11-14 · Atualizado 2021-07-21 · CVE-2019-18938

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions eQ-3 Homematic CCU2 version 2.47.20 eQ-3 Homematic CCU3 version 3.47.18 E-Mail AddOn versions through 1.6.8.c

Description The issue allows remote code execution by unauthenticated attackers with access to the web interface. This is achieved via the "save.cgi" script for payload upload and the "testtcl.cgi" script for its execution.

Recommendations For eQ-3 Homematic CCU2 version 2.47.20, restrict access to the web interface to prevent unauthenticated attackers from exploiting the issue. For eQ-3 Homematic CCU3 version 3.47.18, consider disabling the save.cgi and testtcl.cgi scripts until a fix is available. For E-Mail AddOn versions through 1.6.8.c, avoid using the affected scripts in the web interface until the issue is resolved.

Exploit

Correção

Missing Authentication

Enumeração de Fraquezas

CWE-306

Identificadores relacionados

CVE-2019-18938

Produtos afetados

E-Mail Addon

Eq-3 Homematic Ccu2

Eq-3 Homematic Ccu3

Referências · 3

• 🔥 https://psytester.github.io/CVE-2019-18938 · Exploit
• https://osv.dev/vulnerability/CVE-2019-18938 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2019-18938 · Nota de Segurança