PT-2019-19825 · Eq 3 Ag · Homematic Ccu3

Lukas Zorn + 3 · Publicado 2019-05-13 · Atualizado 2020-08-24 · CVE-2019-9727

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions eQ-3 AG Homematic CCU3 versions 3.43.15 and earlier

Description The issue allows unauthenticated remote attackers to disclose password hashes of GUI users through the User.getUserPWD method. This can be exploited by attackers with access to the web interface.

Recommendations For versions 3.43.15 and earlier, update to a version that fixes this issue to prevent unauthenticated password hash disclosure. As a temporary workaround, consider restricting access to the web interface to minimize the risk of exploitation.

Exploit

Correção

Missing Authentication

Enumeração de Fraquezas

CWE-306

Identificadores relacionados

CVE-2019-9727

Produtos afetados

Homematic Ccu3

Referências · 3

• 🔥 https://atomic111.github.io/article/homematic-ccu3-unauthenticated-password-hash-disclosure · Exploit
• https://osv.dev/vulnerability/CVE-2019-9727 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2019-9727 · Nota de Segurança