PT-2019-13719 · Eq 3 · Eq-3 Homematic Ccu2+1

Psytester · Published 2019-08-05 · Updated 2020-08-24 · CVE-2019-14475

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions eQ-3 Homematic CCU2 versions 2.47.15 and prior eQ-3 Homematic CCU3 versions 3.47.15 and prior

Description The issue concerns a lack of authorization checks in the authentication process, which relies on session IDs. An attacker can exploit this to gain unauthorized access to system functionalities, including reading service messages, clearing the system protocol, creating new users, or modifying and deleting internal programs.

Recommendations For eQ-3 Homematic CCU2 versions 2.47.15 and prior, update to a version that includes proper authorization checks. For eQ-3 Homematic CCU3 versions 3.47.15 and prior, update to a version that includes proper authorization checks. As a temporary workaround, consider restricting access to sensitive system functionalities until a patch is available.

Exploit

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2019-14475

Affected Products

Eq-3 Homematic Ccu2

Eq-3 Homematic Ccu3

References · 3

• 🔥 https://psytester.github.io/CVE-2019-14475 · Exploit
• https://osv.dev/vulnerability/CVE-2019-14475 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-14475 · Security Note