CVE-2019-10121

eQ-3 HomeMatic CCU2 devices before 2.41.8 and CCU3 devices before 3.43.15 use session IDs for authentication but lack authorization checks. An attacker can obtain a session ID via the user authentication dialogue, aka HMCCU-153. This leads to automatic login as admin.
Advertisement

NeevaHost hosting service

Configurations

Configuration 1 (hide)

AND
cpe:2.3:o:eq-3:ccu3_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:eq-3:ccu3:-:*:*:*:*:*:*:*

Configuration 2 (hide)

AND
cpe:2.3:o:eq-3:ccu2_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:eq-3:ccu2:-:*:*:*:*:*:*:*

Information

Published : 2019-07-10 05:15

Updated : 2020-08-24 10:37


NVD link : CVE-2019-10121

Mitre link : CVE-2019-10121


JSON object : View

CWE
CWE-306

Missing Authentication for Critical Function

Advertisement

dedicated server usa

Products Affected

eq-3

  • ccu3
  • ccu2
  • ccu2_firmware
  • ccu3_firmware