PatchTheCVECVE-2019-9726: Directory Traversal / Arbitrary File Read in eQ-3 AG Homematic CCU3 3.43.15 and earlier allows remote attacker
CVE-2019-9726 is a high-severity flaw (CVSS 7.5) affecting ccu3 firmware. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
Directory Traversal / Arbitrary File Read in eQ-3 AG Homematic CCU3 3.43.15 and earlier allows remote attackers to read arbitrary files of the device's filesystem. This vulnerability can be exploited by unauthenticated attackers with access to the web interface.
Why this priority
- High severity
- EPSS top 3%: very likely to be exploited
- Public exploit reference
- Remotely exploitable, no login, no user action
A fixed release or distro patch exists.
Risk facts
| CVSS score | 7.5 (High) |
| Attack vector | Network (remote) |
| Attack complexity | Low |
| Privileges needed | None |
| User interaction | None |
| EPSS exploit chance | 16.3% (top 3%) |
| CISA exploited list | No |
| Weakness | CWE-22 |
| Published | 2019-05-13 |
| Last modified | 2026-06-17 |
Last updated 2026-06-17 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score
Am I affected?
Timeline
- Published CVE record published
- Updated Record last modified
Public exploits and detection
Public code exists for this CVE. Treat unpatched systems as at risk, and only run PoCs in a lab.
- Nuclei scan template: Homematic CCU3 - Local File Inclusion
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Quick answers
How do I fix CVE-2019-9726?
ccu3 firmware: upgrade to newer than 3.43.15. Exact commands for each OS are on this page.
Is CVE-2019-9726 being exploited?
CVE-2019-9726 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.
What does CVE-2019-9726 affect?
CVE-2019-9726 affects ccu3 firmware. Severity is high (CVSS 7.5). Directory Traversal / Arbitrary File Read in eQ-3 AG Homematic CCU3 3.43.15 and earlier allows remote attackers to read arbitrary files of the device's filesystem. This vulnerability can be exploited by unauthenticated attackers with access
How urgent is CVE-2019-9726?
Priority 60/100. High severity; EPSS top 3%: very likely to be exploited; Public exploit reference; Remotely exploitable, no login, no user action
Related CVEs
- CVE-2020-12834 CRITICAL 9.8 UPGRADE UPGRADE eQ-3 Homematic Central Control Unit (CCU)2 through 2.51.6 and CCU3 through 3.51.6 allow Remote Code Execution
- CVE-2019-9727 HIGH 7.5 UPGRADE Unauthenticated password hash disclosure in the User.getUserPWD method in eQ-3 AG Homematic CCU3 3.43.15 and e
- CVE-2019-14475 HIGH 7.5 UPGRADE UPGRADE eQ-3 Homematic CCU2 2.47.15 and prior and CCU3 3.47.15 and prior use session IDs for authentication but lack a
- CVE-2019-14474 HIGH 7.5 UPGRADE eQ-3 Homematic CCU3 3.47.15 and prior has Improper Input Validation in function 'Call()' of ReGa core logic pr
- CVE-2019-14473 HIGH 8.8 UPGRADE UPGRADE eQ-3 Homematic CCU2 and CCU3 use session IDs for authentication but lack authorization checks