CVE-2019-14985

Опубликовано: 13 авг. 2019

Источник: nvd

CVSS3: 9.8

CVSS2: 7.5

EPSS Средний

Описание

eQ-3 Homematic CCU2 and CCU3 with the CUxD AddOn installed allow Remote Code Execution by unauthenticated attackers with access to the web interface, because this interface can access the CMD_EXEC virtual device type 28.

Ссылки

https://psytester.github.io/CVE-2019-14985/
Exploit
Third Party Advisory
https://psytester.github.io/CVE-2019-14985/
Exploit
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

Одновременно

Одно из

cpe:2.3:o:eq-3:homematic_ccu2_firmware:2.35.16:*:*:*:*:*:*:*

cpe:2.3:o:eq-3:homematic_ccu2_firmware:2.41.5:*:*:*:*:*:*:*

cpe:2.3:o:eq-3:homematic_ccu2_firmware:2.41.8:*:*:*:*:*:*:*

cpe:2.3:o:eq-3:homematic_ccu2_firmware:2.41.9:*:*:*:*:*:*:*

cpe:2.3:o:eq-3:homematic_ccu2_firmware:2.45.6:*:*:*:*:*:*:*

cpe:2.3:o:eq-3:homematic_ccu2_firmware:2.45.7:*:*:*:*:*:*:*

cpe:2.3:o:eq-3:homematic_ccu2_firmware:2.47.10:*:*:*:*:*:*:*

cpe:2.3:o:eq-3:homematic_ccu2_firmware:2.47.12:*:*:*:*:*:*:*

cpe:2.3:o:eq-3:homematic_ccu2_firmware:2.47.15:*:*:*:*:*:*:*

cpe:2.3:h:eq-3:homematic_ccu2:-:*:*:*:*:*:*:*

Конфигурация 2

Одновременно

Одно из

cpe:2.3:o:eq-3:homematic_ccu3_firmware:3.41.11:*:*:*:*:*:*:*

cpe:2.3:o:eq-3:homematic_ccu3_firmware:3.43.16:*:*:*:*:*:*:*

cpe:2.3:o:eq-3:homematic_ccu3_firmware:3.45.5:*:*:*:*:*:*:*

cpe:2.3:o:eq-3:homematic_ccu3_firmware:3.45.7:*:*:*:*:*:*:*

cpe:2.3:o:eq-3:homematic_ccu3_firmware:3.47.10:*:*:*:*:*:*:*

cpe:2.3:o:eq-3:homematic_ccu3_firmware:3.47.15:*:*:*:*:*:*:*

cpe:2.3:h:eq-3:homematic_ccu3:-:*:*:*:*:*:*:*

EPSS

Процентиль: 98%

0.49415

Средний

9.8 Critical

CVSS3

7.5 High

CVSS2

Дефекты

CWE-287

Связанные уязвимости

GHSA-3h9w-c639-p2qf

github

больше 3 лет назад