eQ-3 Homematic CCU2 and CCU3 use session IDs for authentication but lack authorization checks. Consequently, a valid guest level or user level account can create a new admin level account, read the service messages, clear the system protocol or modify/delete internal programs, etc. pp.
References
Link | Resource |
---|---|
https://psytester.github.io/CVE-2019-14473 | Exploit Third Party Advisory |
https://psytester.github.io/CVE-2019-14473 | Exploit Third Party Advisory |
Configurations
History
21 Nov 2024, 04:26
Type | Values Removed | Values Added |
---|---|---|
References | () https://psytester.github.io/CVE-2019-14473 - Exploit, Third Party Advisory |
Information
Published : 2019-08-06 19:15
Updated : 2024-11-21 04:26
NVD link : CVE-2019-14473
Mitre link : CVE-2019-14473
CVE.ORG link : CVE-2019-14473
JSON object : View
Products Affected
eq-3
- ccu2_firmware
- ccu2
- ccu3
- ccu3_firmware
CWE
CWE-862
Missing Authorization