CVE-2019-18938
published 2019-11-14CVE-2019-18938: eQ-3 Homematic CCU2 2.47.20 and CCU3 3.47.18 with the E-Mail AddOn through 1.6.8.c installed allow Remote Code Execution by unauthenticated attackers with…
PriorityP273critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
EPSS
33.84%
98.2th percentile
eQ-3 Homematic CCU2 2.47.20 and CCU3 3.47.18 with the E-Mail AddOn through 1.6.8.c installed allow Remote Code Execution by unauthenticated attackers with access to the web interface via the save.cgi script for payload upload and the testtcl.cgi script for its execution.
Affected
16 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| eq-3 | homematic_ccu2_firmware | — | — |
| eq-3 | homematic_ccu3_firmware | — | — |
| hm_email_project | hm_email | — | — |
| hm_email_project | hm_email | — | — |
| hm_email_project | hm_email | — | — |
| hm_email_project | hm_email | — | — |
| hm_email_project | hm_email | — | — |
| hm_email_project | hm_email | — | — |
| hm_email_project | hm_email | — | — |
| hm_email_project | hm_email | — | — |
| hm_email_project | hm_email | — | — |
| hm_email_project | hm_email | — | — |
| hm_email_project | hm_email | — | — |
| hm_email_project | hm_email | — | — |
| hm_email_project | hm_email | — | — |
| hm_email_project | hm_email | — | — |
CVSS provenance
nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv2.07.5HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2019-11-14
Published