PatchTheCVEccu3 firmware vulnerabilities and fixes
Recent CVEs affecting ccu3 firmware, with upgrade or downgrade steps. 10 tracked.
Also searched as: ccu3firmware.
ccu3 firmware has 10 tracked vulnerabilities, 4 critical. A fixed release or vendor patch exists for 10. Most recent: 2020-05-15. Highest priority: CVE-2020-12834 (score 68/100).
- CVE-2020-12834 CRITICAL 9.8 UPGRADE UPGRADE eQ-3 Homematic Central Control Unit (CCU)2 through 2.51.6 and CCU3 through 3.51.6 allow Remote Code Execution
- CVE-2019-9727 HIGH 7.5 UPGRADE Unauthenticated password hash disclosure in the User.getUserPWD method in eQ-3 AG Homematic CCU3 3.43.15 and e
- CVE-2019-9726 HIGH 7.5 UPGRADE Directory Traversal / Arbitrary File Read in eQ-3 AG Homematic CCU3 3.43.15 and earlier allows remote attacker
- CVE-2019-14475 HIGH 7.5 UPGRADE UPGRADE eQ-3 Homematic CCU2 2.47.15 and prior and CCU3 3.47.15 and prior use session IDs for authentication but lack a
- CVE-2019-14474 HIGH 7.5 UPGRADE eQ-3 Homematic CCU3 3.47.15 and prior has Improper Input Validation in function 'Call()' of ReGa core logic pr
- CVE-2019-14473 HIGH 8.8 UPGRADE UPGRADE eQ-3 Homematic CCU2 and CCU3 use session IDs for authentication but lack authorization checks
- CVE-2019-10122 CRITICAL 9.8 UPGRADE UPGRADE eQ-3 HomeMatic CCU2 devices before 2.41.9 and CCU3 devices before 3.43.16 have buffer overflows in the ReGa is
- CVE-2019-10121 CRITICAL 9.8 UPGRADE UPGRADE eQ-3 HomeMatic CCU2 devices before 2.41.8 and CCU3 devices before 3.43.15 use session IDs for authentication b
- CVE-2019-10120 HIGH 8.8 UPGRADE UPGRADE On eQ-3 HomeMatic CCU2 devices before 2.41.8 and CCU3 devices before 3.43.16, automatic login configuration (a
- CVE-2019-10119 CRITICAL 9.8 UPGRADE UPGRADE eQ-3 HomeMatic CCU2 devices before 2.41.8 and CCU3 devices before 3.43.16 use session IDs for authentication b
FAQ
How do I fix ccu3 firmware vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is ccu3 firmware being exploited right now?
None of the tracked ccu3 firmware CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which ccu3 firmware CVE should I patch first?
CVE-2020-12834 currently ranks highest (68/100): eQ-3 Homematic Central Control Unit (CCU)2 through 2.51.6 and CCU3 through 3.51.6 allow Remote Code Execution .