PatchTheCVECVE-2019-16199: eQ-3 Homematic CCU2 before 2.47.18 and CCU3 before 3.47.18 allow Remote Code Execution by unauthenticated atta
CVE-2019-16199 is a critical-severity flaw (CVSS 9.8) affecting homematic ccu2 firmware, homematic ccu3 firmware. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
eQ-3 Homematic CCU2 before 2.47.18 and CCU3 before 3.47.18 allow Remote Code Execution by unauthenticated attackers with access to the web interface via an HTTP POST request to certain URLs related to the ReGa core process.
Why this priority
- Critical severity
- EPSS top 5%: very likely to be exploited
- Public exploit reference
- Remotely exploitable, no login, no user action
A fixed release or distro patch exists.
Risk facts
| CVSS score | 9.8 (Critical) |
| Attack vector | Network (remote) |
| Attack complexity | Low |
| Privileges needed | None |
| User interaction | None |
| EPSS exploit chance | 8.7% (top 5%) |
| CISA exploited list | No |
| Weakness | CWE-306 |
| Published | 2019-09-17 |
| Last modified | 2026-06-17 |
Last updated 2026-06-17 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score
Am I affected?
Timeline
- Published CVE record published
- Updated Record last modified
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Quick answers
How do I fix CVE-2019-16199?
homematic ccu2 firmware: upgrade to 2.47.18; homematic ccu3 firmware: upgrade to 3.47.18. Exact commands for each OS are on this page.
Is CVE-2019-16199 being exploited?
CVE-2019-16199 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.
What does CVE-2019-16199 affect?
CVE-2019-16199 affects homematic ccu2 firmware, homematic ccu3 firmware. Severity is critical (CVSS 9.8). eQ-3 Homematic CCU2 before 2.47.18 and CCU3 before 3.47.18 allow Remote Code Execution by unauthenticated attackers with access to the web interface via an HTTP POST request to certain URLs related to the ReGa core process.
How urgent is CVE-2019-16199?
Priority 68/100. Critical severity; EPSS top 5%: very likely to be exploited; Public exploit reference; Remotely exploitable, no login, no user action
Related CVEs
- CVE-2021-33032 CRITICAL 10.0 UPGRADE UPGRADE A Remote Code Execution (RCE) vulnerability in the WebUI component of the eQ-3 HomeMatic CCU2 firmware up to a
- CVE-2020-12834 CRITICAL 9.8 UPGRADE UPGRADE eQ-3 Homematic Central Control Unit (CCU)2 through 2.51.6 and CCU3 through 3.51.6 allow Remote Code Execution
- CVE-2019-9585 CRITICAL 9.8 UPGRADE UPGRADE eQ-3 Homematic CCU2 prior to 2.47.10 and CCU3 prior to 3.47.10 JSON API has Improper Access Control for Interf
- CVE-2019-9584 CRITICAL 9.8 UPGRADE UPGRADE eQ-3 Homematic AddOn 'CloudMatic' on CCU2 and CCU3 allows uncontrolled admin access, resulting in the ability
- CVE-2019-9583 HIGH 8.2 MITIGATE MITIGATE eQ-3 Homematic CCU2 and CCU3 obtain session IDs without login