Eq-3 Ccu3_firmware
10 CVEs affecting Eq-3 Ccu3_firmware. Latest disclosed: 2020-05-15. Critical: 4, High: 6.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2020-12834 | Critical | 9.8 | 2020-05-15 | eQ-3 Homematic Central Control Unit (CCU)2 through 2.51.6 and CCU3 through 3.51.6 allow Remote Code Execution in the JSON API Method ReGa.runScript, by unauthe… |
CVE-2019-10122 | Critical | 9.8 | 2019-07-10 | eQ-3 HomeMatic CCU2 devices before 2.41.9 and CCU3 devices before 3.43.16 have buffer overflows in the ReGa ise GmbH HTTP-Server 2.0 component, aka HMCCU-179… |
CVE-2019-10121 | Critical | 9.8 | 2019-07-10 | eQ-3 HomeMatic CCU2 devices before 2.41.8 and CCU3 devices before 3.43.15 use session IDs for authentication but lack authorization checks. An attacker can obt… |
CVE-2019-10119 | Critical | 9.8 | 2019-07-10 | eQ-3 HomeMatic CCU2 devices before 2.41.8 and CCU3 devices before 3.43.16 use session IDs for authentication but lack authorization checks. An attacker can obt… |
CVE-2019-14473 | High | 8.8 | 2019-08-06 | eQ-3 Homematic CCU2 and CCU3 use session IDs for authentication but lack authorization checks. Consequently, a valid guest level or user level account can crea… |
CVE-2019-10120 | High | 8.8 | 2019-07-10 | On eQ-3 HomeMatic CCU2 devices before 2.41.8 and CCU3 devices before 3.43.16, automatic login configuration (aka setAutoLogin) can be achieved by continuing to… |
CVE-2019-14474 | High | 7.5 | 2019-08-07 | eQ-3 Homematic CCU3 3.47.15 and prior has Improper Input Validation in function 'Call()' of ReGa core logic process, resulting in the ability to start a Denial… |
CVE-2019-14475 | High | 7.5 | 2019-08-05 | eQ-3 Homematic CCU2 2.47.15 and prior and CCU3 3.47.15 and prior use session IDs for authentication but lack authorization checks. An attacker can obtain a ses… |
CVE-2019-9727 | High | 7.5 | 2019-05-13 | Unauthenticated password hash disclosure in the User.getUserPWD method in eQ-3 AG Homematic CCU3 3.43.15 and earlier allows remote attackers to retrieve the GU… |
CVE-2019-9726 | High | 7.5 | 2019-05-13 | Directory Traversal / Arbitrary File Read in eQ-3 AG Homematic CCU3 3.43.15 and earlier allows remote attackers to read arbitrary files of the device's filesys… |