High severity · published Oct 17, 2019
CVE-2019-15849
eQ-3 HomeMatic CCU3 firmware 3.41.11 allows session fixation
7.3
CVSS
0.8%
EPSS
No
On KEV
Description
eQ-3 HomeMatic CCU3 firmware 3.41.11 allows session fixation. An attacker can create session IDs and send them to the victim. After the victim logs in to the session, the attacker can use that session. The attacker could create SSH logins after a valid session and easily compromise the system.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
Required
Confidentiality
High
Integrity
High
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.8% · higher than 57% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
HC
Homematic Ccu3 Firmware · Eq-3
3.14.11 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2019-15849
CVE.org
https://www.cve.org/CVERecord?id=CVE-2019-15849
Exploit
https://noskill1337.github.io/homematic-ccu3-session-fixation
Vendor Advisory
https://www.eq-3.com/products/homematic.html
More from Homematic Ccu3 Firmware
10.0
CVE-2021-33032
A Remote Code Execution (RCE) vulnerability in the WebUI component of the eQ-3 HomeMatic CCU2 firmware up to and including version 2.57.5 and CCU3 firmware up to and including…
9.8
CVE-2019-18939
eQ-3 Homematic CCU2 2.47.20 and CCU3 3.47.18 with the HM-Print AddOn through 1.2a installed allow Remote Code Execution by unauthenticated attackers with access to the web…
9.8
CVE-2019-18938
eQ-3 Homematic CCU2 2.47.20 and CCU3 3.47.18 with the E-Mail AddOn through 1.6.8.c installed allow Remote Code Execution by unauthenticated attackers with access to the web…
9.8
CVE-2019-18937
eQ-3 Homematic CCU2 2.47.20 and CCU3 3.47.18 with the Script Parser AddOn through 1.8 installed allow Remote Code Execution by unauthenticated attackers with access to the web…
9.8
CVE-2019-16199
eQ-3 Homematic CCU2 before 2.47.18 and CCU3 before 3.47.18 allow Remote Code Execution by unauthenticated attackers with access to the web interface via an HTTP POST request to…