RSS   Vulnerabilities for 'Ccu3 firmware'   RSS

2019-08-14
 
CVE-2019-9583

CWE-400
 

 
eQ-3 Homematic CCU2 and CCU3 obtain session IDs without login. This allows a Denial of Service and is a starting point for other attacks. Affected versions for CCU2: 2.35.16, 2.41.5, 2.41.8, 2.41.9, 2.45.6, 2.45.7, 2.47.10, 2.47.12, 2.47.15. Affected versions for CCU3: 3.41.11, 3.43.16, 3.45.5, 3.45.7, 3.47.10, 3.47.15.

 
2019-08-07
 
CVE-2019-14474

CWE-20
 

 
eQ-3 Homematic CCU3 3.47.15 and prior has Improper Input Validation in function 'Call()' of ReGa core logic process, resulting in the ability to start a Denial of Service. Due to Improper Authorization an attacker can obtain a session ID from CVE-2019-9583 or a valid guest/user/admin account can start this attack too.

 
2019-08-06
 
CVE-2019-14473

CWE-285
 

 
eQ-3 Homematic CCU2 and CCU3 use session IDs for authentication but lack authorization checks. Consequently, a valid guest level or user level account can create a new admin level account, read the service messages, clear the system protocol or modify/delete internal programs, etc. pp.

 
2019-08-05
 
CVE-2019-14475

CWE-285
 

 
eQ-3 Homematic CCU2 2.47.15 and prior and CCU3 3.47.15 and prior use session IDs for authentication but lack authorization checks. An attacker can obtain a session ID from CVE-2019-9583, resulting in the ability to read the service messages, clear the system protocol, create a new user in the system, or modify/delete internal programs.

 
2019-05-13
 
CVE-2019-9727

CWE-255
 

 
Unauthenticated password hash disclosure in the User.getUserPWD method in eQ-3 AG Homematic CCU3 3.43.15 and earlier allows remote attackers to retrieve the GUI password hashes of GUI users. This vulnerability can be exploited by unauthenticated attackers with access to the web interface.

 
 
CVE-2019-9726

CWE-22
 

 
Directory Traversal / Arbitrary File Read in eQ-3 AG Homematic CCU3 3.43.15 and earlier allows remote attackers to read arbitrary files of the device's filesystem. This vulnerability can be exploited by unauthenticated attackers with access to the web interface.

 

 >>> Vendor: EQ-3 5 Products
Homematic central control unit ccu2 firmware
Ccu3 firmware
Ccu2 firmware
Homematic ccu2 firmware
Homematic ccu3 firmware


Copyright 2019, cxsecurity.com

 

Back to Top