CVE-2019-14473

eQ-3 Homematic CCU2 and CCU3 use session IDs for authentication but lack authorization checks. Consequently, a valid guest level or user level account can create a new admin level account, read the service messages, clear the system protocol or modify/delete internal programs, etc. pp.
References
Link Resource
https://psytester.github.io/CVE-2019-14473 Exploit Third Party Advisory
https://psytester.github.io/CVE-2019-14473 Exploit Third Party Advisory
Configurations

Configuration 1 (hide)

AND
cpe:2.3:o:eq-3:ccu2_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:eq-3:ccu2:-:*:*:*:*:*:*:*

Configuration 2 (hide)

AND
cpe:2.3:o:eq-3:ccu3_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:eq-3:ccu3:-:*:*:*:*:*:*:*

History

21 Nov 2024, 04:26

Type Values Removed Values Added
References () https://psytester.github.io/CVE-2019-14473 - Exploit, Third Party Advisory () https://psytester.github.io/CVE-2019-14473 - Exploit, Third Party Advisory

Information

Published : 2019-08-06 19:15

Updated : 2024-11-21 04:26


NVD link : CVE-2019-14473

Mitre link : CVE-2019-14473

CVE.ORG link : CVE-2019-14473


JSON object : View

Products Affected

eq-3

  • ccu2_firmware
  • ccu2
  • ccu3
  • ccu3_firmware
CWE
CWE-862

Missing Authorization