homematic ccu3 firmware vulnerabilities and fixes

Recent CVEs affecting homematic ccu3 firmware, with upgrade or downgrade steps. 13 tracked.

Also searched as: homematicccu3firmware.

homematic ccu3 firmware has 13 tracked vulnerabilities, 8 critical. A fixed release or vendor patch exists for 6. Most recent: 2021-07-22. Highest priority: CVE-2021-33032 (score 70/100).

• CVE-2021-33032 CRITICAL 10.0 UPGRADE UPGRADE A Remote Code Execution (RCE) vulnerability in the WebUI component of the eQ-3 HomeMatic CCU2 firmware up to a
• CVE-2019-9585 CRITICAL 9.8 UPGRADE UPGRADE eQ-3 Homematic CCU2 prior to 2.47.10 and CCU3 prior to 3.47.10 JSON API has Improper Access Control for Interf
• CVE-2019-9584 CRITICAL 9.8 UPGRADE UPGRADE eQ-3 Homematic AddOn 'CloudMatic' on CCU2 and CCU3 allows uncontrolled admin access, resulting in the ability
• CVE-2019-9583 HIGH 8.2 MITIGATE MITIGATE eQ-3 Homematic CCU2 and CCU3 obtain session IDs without login
• CVE-2019-18939 CRITICAL 9.8 DOWNGRADE MITIGATE eQ-3 Homematic CCU2 2.47.20 and CCU3 3.47.18 with the HM-Print AddOn through 1.2a installed allow Remote Code
• CVE-2019-18938 CRITICAL 9.8 DOWNGRADE MITIGATE eQ-3 Homematic CCU2 2.47.20 and CCU3 3.47.18 with the E-Mail AddOn through 1.6.8.c installed allow Remote Code
• CVE-2019-18937 CRITICAL 9.8 DOWNGRADE MITIGATE eQ-3 Homematic CCU2 2.47.20 and CCU3 3.47.18 with the Script Parser AddOn through 1.8 installed allow Remote C
• CVE-2019-16199 CRITICAL 9.8 UPGRADE UPGRADE eQ-3 Homematic CCU2 before 2.47.18 and CCU3 before 3.47.18 allow Remote Code Execution by unauthenticated atta
• CVE-2019-15850 HIGH 8.8 MITIGATE eQ-3 HomeMatic CCU3 firmware version 3.41.11 allows Remote Code Execution in the ReGa.runScript method
• CVE-2019-15849 HIGH 7.3 MITIGATE eQ-3 HomeMatic CCU3 firmware 3.41.11 allows session fixation
• CVE-2019-14986 HIGH 8.1 UPGRADE UPGRADE eQ-3 Homematic CCU2 and CCU3 with the CUxD AddOn before 2.3.0 installed allow administrative operations by una
• CVE-2019-14985 CRITICAL 9.8 MITIGATE MITIGATE eQ-3 Homematic CCU2 and CCU3 with the CUxD AddOn installed allow Remote Code Execution by unauthenticated atta
• CVE-2019-14984 HIGH 8.1 UPGRADE UPGRADE eQ-3 Homematic CCU2 and CCU3 with the XML-API through 1.2.0 AddOn installed allow Remote Code Execution by una

FAQ

How do I fix homematic ccu3 firmware vulnerabilities?

Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.

Is homematic ccu3 firmware being exploited right now?

None of the tracked homematic ccu3 firmware CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.

Which homematic ccu3 firmware CVE should I patch first?

CVE-2021-33032 currently ranks highest (70/100): A Remote Code Execution (RCE) vulnerability in the WebUI component of the eQ-3 HomeMatic CCU2 firmware up to a.

RSS feed for homematic ccu3 firmware · ← Back to latest CVEs