Описание
eQ-3 Homematic CCU2 and CCU3 with the XML-API through 1.2.0 AddOn installed allow Remote Code Execution by unauthenticated attackers with access to the web interface, because the undocumented addons/xmlapi/exec.cgi script uses CMD_EXEC to execute TCL code from a POST request.
Ссылки
- ExploitThird Party Advisory
- ExploitThird Party Advisory
Уязвимые конфигурации
Конфигурация 1Версия до 1.2.0 (включая)
Одновременно
cpe:2.3:o:eq-3:homematic_ccu2_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:eq-3:homematic_ccu2:-:*:*:*:*:*:*:*
Конфигурация 2Версия до 1.2.0 (включая)
Одновременно
cpe:2.3:o:eq-3:homematic_ccu3_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:eq-3:homematic_ccu3:-:*:*:*:*:*:*:*
EPSS
Процентиль: 93%
0.10704
Средний
8.1 High
CVSS3
6.8 Medium
CVSS2
Дефекты
CWE-306
Связанные уязвимости
github
больше 3 лет назад
eQ-3 Homematic CCU2 and CCU3 with the XML-API through 1.2.0 AddOn installed allow Remote Code Execution by unauthenticated attackers with access to the web interface, because the undocumented addons/xmlapi/exec.cgi script uses CMD_EXEC to execute TCL code from a POST request.
EPSS
Процентиль: 93%
0.10704
Средний
8.1 High
CVSS3
6.8 Medium
CVSS2
Дефекты
CWE-306