Critical severity · published Aug 13, 2019
CVE-2019-14985
eQ-3 Homematic CCU2 and CCU3 with the CUxD AddOn installed allow Remote Code Execution by unauthenticated attackers with access to the web interface, because this interface can…
9.8
CVSS
7.5%
EPSS
No
On KEV
Description
eQ-3 Homematic CCU2 and CCU3 with the CUxD AddOn installed allow Remote Code Execution by unauthenticated attackers with access to the web interface, because this interface can access the CMD_EXEC virtual device type 28.
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)7.5% · higher than 94% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
HC
Homematic Ccu2 Firmware · Eq-3
2.35.16; 2.41.5; 2.41.8; 2.41.9; 2.45.6; 2.45.7; +3 more · source: NVD
HC
Homematic Ccu3 Firmware · Eq-3
3.41.11; 3.43.16; 3.45.5; 3.45.7; 3.47.10; 3.47.15 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2019-14985
CVE.org
https://www.cve.org/CVERecord?id=CVE-2019-14985
Exploit
https://psytester.github.io/CVE-2019-14985/
More from Homematic Ccu2 Firmware
10.0
CVE-2021-33032
A Remote Code Execution (RCE) vulnerability in the WebUI component of the eQ-3 HomeMatic CCU2 firmware up to and including version 2.57.5 and CCU3 firmware up to and including…
9.8
CVE-2020-12834
eQ-3 Homematic Central Control Unit (CCU)2 through 2.51.6 and CCU3 through 3.51.6 allow Remote Code Execution in the JSON API Method ReGa.runScript, by unauthenticated attackers…
9.8
CVE-2019-18939
eQ-3 Homematic CCU2 2.47.20 and CCU3 3.47.18 with the HM-Print AddOn through 1.2a installed allow Remote Code Execution by unauthenticated attackers with access to the web…
9.8
CVE-2019-18938
eQ-3 Homematic CCU2 2.47.20 and CCU3 3.47.18 with the E-Mail AddOn through 1.6.8.c installed allow Remote Code Execution by unauthenticated attackers with access to the web…
9.8
CVE-2019-18937
eQ-3 Homematic CCU2 2.47.20 and CCU3 3.47.18 with the Script Parser AddOn through 1.8 installed allow Remote Code Execution by unauthenticated attackers with access to the web…