CF
Product
Ccu3 Firmware
10
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 4High 6Medium 0Low 0
Watch
Add Ccu3 Firmware to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2019-14473 | 8.8 | Aug 6 | eQ-3 Homematic CCU2 and CCU3 use session IDs for authentication but lack authorization checks Affected: through 3.47.15 |
| CVE-2019-10120 | 8.8 | Jul 10 | On eQ-3 HomeMatic CCU2 devices before 2.41.8 and CCU3 devices before 3.43.16, automatic login configuration (aka setAutoLogin) can be achieved by continuing to use a session ID… Affected: before 3.43.16 |
| CVE-2019-14474 | 7.5 | Aug 7 | eQ-3 Homematic CCU3 3.47.15 and prior has Improper Input Validation in function 'Call()' of ReGa core logic process, resulting in the ability to start a Denial of Service Affected: through 3.47.15 |
| CVE-2019-14475 | 7.5 | Aug 5 | eQ-3 Homematic CCU2 2.47.15 and prior and CCU3 3.47.15 and prior use session IDs for authentication but lack authorization checks Affected: through 3.47.15 |
| CVE-2019-9727 | 7.5 | May 13 | Unauthenticated password hash disclosure in the User.getUserPWD method in eQ-3 AG Homematic CCU3 3.43.15 and earlier allows remote attackers to retrieve the GUI password hashes of… Affected: through 3.43.15 |
| CVE-2019-9726 | 7.5 | May 13 | Directory Traversal / Arbitrary File Read in eQ-3 AG Homematic CCU3 3.43.15 and earlier allows remote attackers to read arbitrary files of the device's filesystem Affected: through 3.43.15 |
Showing 6