PatchTheCVEccu2 firmware vulnerabilities and fixes
Recent CVEs affecting ccu2 firmware, with upgrade or downgrade steps. 8 tracked.
Also searched as: ccu2firmware.
ccu2 firmware has 8 tracked vulnerabilities, 3 critical. A fixed release or vendor patch exists for 8. Most recent: 2019-10-17. Highest priority: CVE-2019-10122 (score 62/100).
- CVE-2019-14475 HIGH 7.5 UPGRADE UPGRADE eQ-3 Homematic CCU2 2.47.15 and prior and CCU3 3.47.15 and prior use session IDs for authentication but lack a
- CVE-2019-14473 HIGH 8.8 UPGRADE UPGRADE eQ-3 Homematic CCU2 and CCU3 use session IDs for authentication but lack authorization checks
- CVE-2019-14424 MEDIUM 6.5 UPGRADE UPGRADE A Local File Inclusion (LFI) issue in the addon CUx-Daemon 1.11a of the eQ-3 Homematic CCU-Firmware 2.35.16 un
- CVE-2019-14423 HIGH 8.8 UPGRADE UPGRADE A Remote Code Execution (RCE) issue in the addon CUx-Daemon 1.11a of the eQ-3 Homematic CCU-Firmware 2.35.16 u
- CVE-2019-10122 CRITICAL 9.8 UPGRADE UPGRADE eQ-3 HomeMatic CCU2 devices before 2.41.9 and CCU3 devices before 3.43.16 have buffer overflows in the ReGa is
- CVE-2019-10121 CRITICAL 9.8 UPGRADE UPGRADE eQ-3 HomeMatic CCU2 devices before 2.41.8 and CCU3 devices before 3.43.15 use session IDs for authentication b
- CVE-2019-10120 HIGH 8.8 UPGRADE UPGRADE On eQ-3 HomeMatic CCU2 devices before 2.41.8 and CCU3 devices before 3.43.16, automatic login configuration (a
- CVE-2019-10119 CRITICAL 9.8 UPGRADE UPGRADE eQ-3 HomeMatic CCU2 devices before 2.41.8 and CCU3 devices before 3.43.16 use session IDs for authentication b
FAQ
How do I fix ccu2 firmware vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is ccu2 firmware being exploited right now?
None of the tracked ccu2 firmware CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which ccu2 firmware CVE should I patch first?
CVE-2019-10122 currently ranks highest (62/100): eQ-3 HomeMatic CCU2 devices before 2.41.9 and CCU3 devices before 3.43.16 have buffer overflows in the ReGa is.