homematic ccu2 firmware vulnerabilities and fixes

Recent CVEs affecting homematic ccu2 firmware, with upgrade or downgrade steps. 14 tracked.

Also searched as: homematicccu2firmware.

homematic ccu2 firmware has 14 tracked vulnerabilities, 10 critical. A fixed release or vendor patch exists for 8. Most recent: 2021-07-22. Highest priority: CVE-2021-33032 (score 70/100).

• CVE-2021-33032 CRITICAL 10.0 UPGRADE UPGRADE A Remote Code Execution (RCE) vulnerability in the WebUI component of the eQ-3 HomeMatic CCU2 firmware up to a
• CVE-2020-12834 CRITICAL 9.8 UPGRADE UPGRADE eQ-3 Homematic Central Control Unit (CCU)2 through 2.51.6 and CCU3 through 3.51.6 allow Remote Code Execution
• CVE-2019-9585 CRITICAL 9.8 UPGRADE UPGRADE eQ-3 Homematic CCU2 prior to 2.47.10 and CCU3 prior to 3.47.10 JSON API has Improper Access Control for Interf
• CVE-2019-9584 CRITICAL 9.8 UPGRADE UPGRADE eQ-3 Homematic AddOn 'CloudMatic' on CCU2 and CCU3 allows uncontrolled admin access, resulting in the ability
• CVE-2019-9583 HIGH 8.2 MITIGATE MITIGATE eQ-3 Homematic CCU2 and CCU3 obtain session IDs without login
• CVE-2019-9582 HIGH 7.5 MITIGATE eQ-3 Homematic CCU2 outdated base software packages allows Denial of Service
• CVE-2019-18939 CRITICAL 9.8 DOWNGRADE MITIGATE eQ-3 Homematic CCU2 2.47.20 and CCU3 3.47.18 with the HM-Print AddOn through 1.2a installed allow Remote Code
• CVE-2019-18938 CRITICAL 9.8 DOWNGRADE MITIGATE eQ-3 Homematic CCU2 2.47.20 and CCU3 3.47.18 with the E-Mail AddOn through 1.6.8.c installed allow Remote Code
• CVE-2019-18937 CRITICAL 9.8 DOWNGRADE MITIGATE eQ-3 Homematic CCU2 2.47.20 and CCU3 3.47.18 with the Script Parser AddOn through 1.8 installed allow Remote C
• CVE-2019-16199 CRITICAL 9.8 UPGRADE UPGRADE eQ-3 Homematic CCU2 before 2.47.18 and CCU3 before 3.47.18 allow Remote Code Execution by unauthenticated atta
• CVE-2019-14986 HIGH 8.1 UPGRADE UPGRADE eQ-3 Homematic CCU2 and CCU3 with the CUxD AddOn before 2.3.0 installed allow administrative operations by una
• CVE-2019-14985 CRITICAL 9.8 MITIGATE MITIGATE eQ-3 Homematic CCU2 and CCU3 with the CUxD AddOn installed allow Remote Code Execution by unauthenticated atta
• CVE-2019-14984 HIGH 8.1 UPGRADE UPGRADE eQ-3 Homematic CCU2 and CCU3 with the XML-API through 1.2.0 AddOn installed allow Remote Code Execution by una
• CVE-2018-7300 CRITICAL 9.8 UPGRADE Directory Traversal / Arbitrary File Write / Remote Code Execution in the User.setLanguage method in eQ-3 AG H

FAQ

How do I fix homematic ccu2 firmware vulnerabilities?

Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.

Is homematic ccu2 firmware being exploited right now?

None of the tracked homematic ccu2 firmware CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.

Which homematic ccu2 firmware CVE should I patch first?

CVE-2021-33032 currently ranks highest (70/100): A Remote Code Execution (RCE) vulnerability in the WebUI component of the eQ-3 HomeMatic CCU2 firmware up to a.

RSS feed for homematic ccu2 firmware · ← Back to latest CVEs