Login Request a demo
CF
Product
Ccu3 Firmware
by Eq-3 · last CVE May 15, 2020
10
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Vulnerabilities10In the news0Timeline
Severity mix
Critical 4High 6Medium 0Low 0
Severity
All severities10Critical4High6Medium0Low0
Exploitation
On CISA KEV0Exploited in the wild0
Watch

Add Ccu3 Firmware to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2020-12834
9.8
11%
May 15
eQ-3 Homematic Central Control Unit (CCU)2 through 2.51.6 and CCU3 through 3.51.6 allow Remote Code Execution in the JSON API Method ReGa.runScript, by unauthenticated attackers…
Affected: through 3.51.6
CVE-2019-10122
9.8
4%
Jul 10
eQ-3 HomeMatic CCU2 devices before 2.41.9 and CCU3 devices before 3.43.16 have buffer overflows in the ReGa ise GmbH HTTP-Server 2.0 component, aka HMCCU-179
Affected: before 3.43.16
CVE-2019-10121
9.8
5%
Jul 10
eQ-3 HomeMatic CCU2 devices before 2.41.8 and CCU3 devices before 3.43.15 use session IDs for authentication but lack authorization checks
Affected: before 3.43.15
CVE-2019-10119
9.8
2%
Jul 10
eQ-3 HomeMatic CCU2 devices before 2.41.8 and CCU3 devices before 3.43.16 use session IDs for authentication but lack authorization checks
Affected: before 3.43.16
CVE-2019-14473
8.8
2%
Aug 6
eQ-3 Homematic CCU2 and CCU3 use session IDs for authentication but lack authorization checks
Affected: through 3.47.15
CVE-2019-10120
8.8
1%
Jul 10
On eQ-3 HomeMatic CCU2 devices before 2.41.8 and CCU3 devices before 3.43.16, automatic login configuration (aka setAutoLogin) can be achieved by continuing to use a session ID…
Affected: before 3.43.16
CVE-2019-14474
7.5
2%
Aug 7
eQ-3 Homematic CCU3 3.47.15 and prior has Improper Input Validation in function 'Call()' of ReGa core logic process, resulting in the ability to start a Denial of Service
Affected: through 3.47.15
CVE-2019-14475
7.5
2%
Aug 5
eQ-3 Homematic CCU2 2.47.15 and prior and CCU3 3.47.15 and prior use session IDs for authentication but lack authorization checks
Affected: through 3.47.15
CVE-2019-9727
7.5
2%
May 13
Unauthenticated password hash disclosure in the User.getUserPWD method in eQ-3 AG Homematic CCU3 3.43.15 and earlier allows remote attackers to retrieve the GUI password hashes of…
Affected: through 3.43.15
CVE-2019-9726
7.5
16%
May 13
Directory Traversal / Arbitrary File Read in eQ-3 AG Homematic CCU3 3.43.15 and earlier allows remote attackers to read arbitrary files of the device's filesystem
Affected: through 3.43.15
Showing 10