Описание
A Remote Code Execution (RCE) vulnerability in the WebUI component of the eQ-3 HomeMatic CCU2 firmware up to and including version 2.57.5 and CCU3 firmware up to and including version 3.57.5 allows remote unauthenticated attackers to execute system commands as root via a simple HTTP request.
Ссылки
- ExploitThird Party Advisory
- Release NotesVendor Advisory
- Release NotesVendor Advisory
- ExploitThird Party Advisory
- Release NotesVendor Advisory
- Release NotesVendor Advisory
Уязвимые конфигурации
Конфигурация 1Версия до 2.57.5 (включая)
Одновременно
cpe:2.3:o:eq-3:homematic_ccu2_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:eq-3:homematic_ccu2:-:*:*:*:*:*:*:*
Конфигурация 2Версия до 3.57.5 (включая)
Одновременно
cpe:2.3:o:eq-3:homematic_ccu3_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:eq-3:homematic_ccu3:-:*:*:*:*:*:*:*
EPSS
Процентиль: 98%
0.50215
Средний
10 Critical
CVSS3
10 Critical
CVSS2
Дефекты
CWE-78
Связанные уязвимости
github
больше 3 лет назад
eQ-3 HomeMatic CCU2 2.57.5 and CCU3 3.57.5 devices allow remote code execution.
EPSS
Процентиль: 98%
0.50215
Средний
10 Critical
CVSS3
10 Critical
CVSS2
Дефекты
CWE-78