EQ
Vendor
Eq-3
52
CVEs
0
On KEV
0
New 30D
Products
HC10.0
Homematic Ccu2 Firmware
Eq-3
14 CVEs0 on KEV0 new
HC10.0
Homematic Ccu3 Firmware
Eq-3
13 CVEs0 on KEV0 new
CF9.8
Ccu3 Firmware
Eq-3
10 CVEs0 on KEV0 new
CF9.8
Ccu2 Firmware
Eq-3
8 CVEs0 on KEV0 new
HC9.8
Homematic Central Control Unit Ccu2 Firmware
Eq-3
5 CVEs0 on KEV0 new
CU8.8
Cux-daemon
Eq-3
2 CVEs0 on KEV0 new
Recent CVEs
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2021-33032 | HC Homematic Ccu2 Firmware Eq-3 | 10.0 | Jul 22 | A Remote Code Execution (RCE) vulnerability in the WebUI component of the eQ-3 HomeMatic CCU2 firmware up to and including version 2.57.5 and CCU3 firmware up to and including… |
| CVE-2020-12834 | HC Homematic Ccu2 Firmware Eq-3 | 9.8 | May 15 | eQ-3 Homematic Central Control Unit (CCU)2 through 2.51.6 and CCU3 through 3.51.6 allow Remote Code Execution in the JSON API Method ReGa.runScript, by unauthenticated attackers… |
| CVE-2019-18939 | HC Homematic Ccu2 Firmware Eq-3 | 9.8 | Nov 14 | eQ-3 Homematic CCU2 2.47.20 and CCU3 3.47.18 with the HM-Print AddOn through 1.2a installed allow Remote Code Execution by unauthenticated attackers with access to the web… |
| CVE-2019-18938 | HC Homematic Ccu2 Firmware Eq-3 | 9.8 | Nov 14 | eQ-3 Homematic CCU2 2.47.20 and CCU3 3.47.18 with the E-Mail AddOn through 1.6.8.c installed allow Remote Code Execution by unauthenticated attackers with access to the web… |
| CVE-2019-18937 | HC Homematic Ccu2 Firmware Eq-3 | 9.8 | Nov 14 | eQ-3 Homematic CCU2 2.47.20 and CCU3 3.47.18 with the Script Parser AddOn through 1.8 installed allow Remote Code Execution by unauthenticated attackers with access to the web… |
| CVE-2019-15850 | HC Homematic Ccu3 Firmware Eq-3 | 8.8 | Oct 17 | eQ-3 HomeMatic CCU3 firmware version 3.41.11 allows Remote Code Execution in the ReGa.runScript method |
| CVE-2019-15849 | HC Homematic Ccu3 Firmware Eq-3 | 7.3 | Oct 17 | eQ-3 HomeMatic CCU3 firmware 3.41.11 allows session fixation |
| CVE-2019-14424 | CU Cux-daemon Eq-3 | 6.5 | Oct 17 | A Local File Inclusion (LFI) issue in the addon CUx-Daemon 1.11a of the eQ-3 Homematic CCU-Firmware 2.35.16 until 2.45.6 allows remote authenticated attackers to read sensitive… |
| CVE-2019-14423 | CU Cux-daemon Eq-3 | 8.8 | Oct 17 | A Remote Code Execution (RCE) issue in the addon CUx-Daemon 1.11a of the eQ-3 Homematic CCU-Firmware 2.35.16 until 2.45.6 allows remote authenticated attackers to execute system… |
| CVE-2019-16199 | HC Homematic Ccu2 Firmware Eq-3 | 9.8 | Sep 17 | eQ-3 Homematic CCU2 before 2.47.18 and CCU3 before 3.47.18 allow Remote Code Execution by unauthenticated attackers with access to the web interface via an HTTP POST request to… |
| CVE-2019-9585 | HC Homematic Ccu2 Firmware Eq-3 | 9.8 | Aug 14 | eQ-3 Homematic CCU2 prior to 2.47.10 and CCU3 prior to 3.47.10 JSON API has Improper Access Control for Interface.***Metadata related operations, resulting in the ability to read,… |
| CVE-2019-9584 | HC Homematic Ccu2 Firmware Eq-3 | 9.8 | Aug 14 | eQ-3 Homematic AddOn 'CloudMatic' on CCU2 and CCU3 allows uncontrolled admin access, resulting in the ability to obtain VPN profile details, shutting down the VPN service and to… |
| CVE-2019-9583 | HC Homematic Ccu3 Firmware Eq-3 | 8.2 | Aug 14 | eQ-3 Homematic CCU2 and CCU3 obtain session IDs without login |
| CVE-2019-9582 | HC Homematic Ccu2 Firmware Eq-3 | 7.5 | Aug 14 | eQ-3 Homematic CCU2 outdated base software packages allows Denial of Service |
| CVE-2019-14986 | HC Homematic Ccu2 Firmware Eq-3 | 8.1 | Aug 13 | eQ-3 Homematic CCU2 and CCU3 with the CUxD AddOn before 2.3.0 installed allow administrative operations by unauthenticated attackers with access to the web interface, because… |
| CVE-2019-14985 | HC Homematic Ccu2 Firmware Eq-3 | 9.8 | Aug 13 | eQ-3 Homematic CCU2 and CCU3 with the CUxD AddOn installed allow Remote Code Execution by unauthenticated attackers with access to the web interface, because this interface can… |
| CVE-2019-14984 | HC Homematic Ccu2 Firmware Eq-3 | 8.1 | Aug 13 | eQ-3 Homematic CCU2 and CCU3 with the XML-API through 1.2.0 AddOn installed allow Remote Code Execution by unauthenticated attackers with access to the web interface, because the… |
| CVE-2019-14474 | CF Ccu3 Firmware Eq-3 | 7.5 | Aug 7 | eQ-3 Homematic CCU3 3.47.15 and prior has Improper Input Validation in function 'Call()' of ReGa core logic process, resulting in the ability to start a Denial of Service |
| CVE-2019-14473 | CF Ccu2 Firmware Eq-3 | 8.8 | Aug 6 | eQ-3 Homematic CCU2 and CCU3 use session IDs for authentication but lack authorization checks |
| CVE-2019-14475 | CF Ccu2 Firmware Eq-3 | 7.5 | Aug 5 | eQ-3 Homematic CCU2 2.47.15 and prior and CCU3 3.47.15 and prior use session IDs for authentication but lack authorization checks |
| CVE-2019-10122 | CF Ccu3 Firmware Eq-3 | 9.8 | Jul 10 | eQ-3 HomeMatic CCU2 devices before 2.41.9 and CCU3 devices before 3.43.16 have buffer overflows in the ReGa ise GmbH HTTP-Server 2.0 component, aka HMCCU-179 |
| CVE-2019-10121 | CF Ccu3 Firmware Eq-3 | 9.8 | Jul 10 | eQ-3 HomeMatic CCU2 devices before 2.41.8 and CCU3 devices before 3.43.15 use session IDs for authentication but lack authorization checks |
| CVE-2019-10120 | CF Ccu3 Firmware Eq-3 | 8.8 | Jul 10 | On eQ-3 HomeMatic CCU2 devices before 2.41.8 and CCU3 devices before 3.43.16, automatic login configuration (aka setAutoLogin) can be achieved by continuing to use a session ID… |
| CVE-2019-10119 | CF Ccu3 Firmware Eq-3 | 9.8 | Jul 10 | eQ-3 HomeMatic CCU2 devices before 2.41.8 and CCU3 devices before 3.43.16 use session IDs for authentication but lack authorization checks |
| CVE-2019-9727 | CF Ccu3 Firmware Eq-3 | 7.5 | May 13 | Unauthenticated password hash disclosure in the User.getUserPWD method in eQ-3 AG Homematic CCU3 3.43.15 and earlier allows remote attackers to retrieve the GUI password hashes of… |
| CVE-2019-9726 | CF Ccu3 Firmware Eq-3 | 7.5 | May 13 | Directory Traversal / Arbitrary File Read in eQ-3 AG Homematic CCU3 3.43.15 and earlier allows remote attackers to read arbitrary files of the device's filesystem |
| CVE-2018-7301 | HC Homematic Central Control Unit Ccu2 Firmware Eq-3 | 9.8 | Feb 22 | eQ-3 AG HomeMatic CCU2 2.29.22 devices have an open XML-RPC port without authentication |
| CVE-2018-7300 | HC Homematic Ccu2 Firmware Eq-3 | 9.8 | Feb 22 | Directory Traversal / Arbitrary File Write / Remote Code Execution in the User.setLanguage method in eQ-3 AG Homematic CCU2 2.29.2 and earlier allows remote attackers to write… |
| CVE-2018-7299 | HC Homematic Central Control Unit Ccu2 Firmware Eq-3 | 8.0 | Feb 22 | Remote Code Execution in the addon installation process in eQ-3 AG Homematic CCU2 2.29.2 and earlier allows authenticated attackers to create or overwrite arbitrary files or… |
| CVE-2018-7298 | HC Homematic Central Control Unit Ccu2 Firmware Eq-3 | 8.1 | Feb 22 | In /usr/local/etc/config/addons/mh/loopupd.sh on eQ-3 AG HomeMatic CCU2 2.29.22 devices, software update packages are downloaded via the HTTP protocol, which does not provide any… |
| CVE-2018-7297 | HC Homematic Central Control Unit Ccu2 Firmware Eq-3 | 9.8 | Feb 22 | Remote Code Execution in the TCL script interpreter in eQ-3 AG Homematic CCU2 2.29.2 and earlier allows remote attackers to obtain read/write access and execute system commands on… |
| CVE-2018-7296 | HC Homematic Central Control Unit Ccu2 Firmware Eq-3 | 5.3 | Feb 22 | Directory Traversal / Arbitrary File Read in User.getLanguage method in eQ-3 AG Homematic CCU2 2.29.2 and earlier allows remote attackers to read the first line of an arbitrary… |