eq-3 vulnerabilities

Recent CVEs affecting eq-3 products. 32 tracked.

eq-3 has 32 tracked vulnerabilities, 15 critical. A fixed release or vendor patch exists for 22. Most recent: 2021-07-22. Highest priority: CVE-2021-33032 (score 70/100).

CVE-2021-33032 CRITICAL 10.0 UPGRADE UPGRADE A Remote Code Execution (RCE) vulnerability in the WebUI component of the eQ-3 HomeMatic CCU2 firmware up to a
CVE-2020-12834 CRITICAL 9.8 UPGRADE UPGRADE eQ-3 Homematic Central Control Unit (CCU)2 through 2.51.6 and CCU3 through 3.51.6 allow Remote Code Execution
CVE-2019-9727 HIGH 7.5 UPGRADE Unauthenticated password hash disclosure in the User.getUserPWD method in eQ-3 AG Homematic CCU3 3.43.15 and e
CVE-2019-9726 HIGH 7.5 UPGRADE Directory Traversal / Arbitrary File Read in eQ-3 AG Homematic CCU3 3.43.15 and earlier allows remote attacker
CVE-2019-9585 CRITICAL 9.8 UPGRADE UPGRADE eQ-3 Homematic CCU2 prior to 2.47.10 and CCU3 prior to 3.47.10 JSON API has Improper Access Control for Interf
CVE-2019-9584 CRITICAL 9.8 UPGRADE UPGRADE eQ-3 Homematic AddOn 'CloudMatic' on CCU2 and CCU3 allows uncontrolled admin access, resulting in the ability
CVE-2019-9583 HIGH 8.2 MITIGATE MITIGATE eQ-3 Homematic CCU2 and CCU3 obtain session IDs without login
CVE-2019-9582 HIGH 7.5 MITIGATE eQ-3 Homematic CCU2 outdated base software packages allows Denial of Service
CVE-2019-18939 CRITICAL 9.8 DOWNGRADE MITIGATE eQ-3 Homematic CCU2 2.47.20 and CCU3 3.47.18 with the HM-Print AddOn through 1.2a installed allow Remote Code
CVE-2019-18938 CRITICAL 9.8 DOWNGRADE MITIGATE eQ-3 Homematic CCU2 2.47.20 and CCU3 3.47.18 with the E-Mail AddOn through 1.6.8.c installed allow Remote Code
CVE-2019-18937 CRITICAL 9.8 DOWNGRADE MITIGATE eQ-3 Homematic CCU2 2.47.20 and CCU3 3.47.18 with the Script Parser AddOn through 1.8 installed allow Remote C
CVE-2019-16199 CRITICAL 9.8 UPGRADE UPGRADE eQ-3 Homematic CCU2 before 2.47.18 and CCU3 before 3.47.18 allow Remote Code Execution by unauthenticated atta
CVE-2019-15850 HIGH 8.8 MITIGATE eQ-3 HomeMatic CCU3 firmware version 3.41.11 allows Remote Code Execution in the ReGa.runScript method
CVE-2019-15849 HIGH 7.3 MITIGATE eQ-3 HomeMatic CCU3 firmware 3.41.11 allows session fixation
CVE-2019-14986 HIGH 8.1 UPGRADE UPGRADE eQ-3 Homematic CCU2 and CCU3 with the CUxD AddOn before 2.3.0 installed allow administrative operations by una
CVE-2019-14985 CRITICAL 9.8 MITIGATE MITIGATE eQ-3 Homematic CCU2 and CCU3 with the CUxD AddOn installed allow Remote Code Execution by unauthenticated atta
CVE-2019-14984 HIGH 8.1 UPGRADE UPGRADE eQ-3 Homematic CCU2 and CCU3 with the XML-API through 1.2.0 AddOn installed allow Remote Code Execution by una
CVE-2019-14475 HIGH 7.5 UPGRADE UPGRADE eQ-3 Homematic CCU2 2.47.15 and prior and CCU3 3.47.15 and prior use session IDs for authentication but lack a
CVE-2019-14474 HIGH 7.5 UPGRADE eQ-3 Homematic CCU3 3.47.15 and prior has Improper Input Validation in function 'Call()' of ReGa core logic pr
CVE-2019-14473 HIGH 8.8 UPGRADE UPGRADE eQ-3 Homematic CCU2 and CCU3 use session IDs for authentication but lack authorization checks
CVE-2019-14424 MEDIUM 6.5 UPGRADE UPGRADE A Local File Inclusion (LFI) issue in the addon CUx-Daemon 1.11a of the eQ-3 Homematic CCU-Firmware 2.35.16 un
CVE-2019-14423 HIGH 8.8 UPGRADE UPGRADE A Remote Code Execution (RCE) issue in the addon CUx-Daemon 1.11a of the eQ-3 Homematic CCU-Firmware 2.35.16 u
CVE-2019-10122 CRITICAL 9.8 UPGRADE UPGRADE eQ-3 HomeMatic CCU2 devices before 2.41.9 and CCU3 devices before 3.43.16 have buffer overflows in the ReGa is
CVE-2019-10121 CRITICAL 9.8 UPGRADE UPGRADE eQ-3 HomeMatic CCU2 devices before 2.41.8 and CCU3 devices before 3.43.15 use session IDs for authentication b
CVE-2019-10120 HIGH 8.8 UPGRADE UPGRADE On eQ-3 HomeMatic CCU2 devices before 2.41.8 and CCU3 devices before 3.43.16, automatic login configuration (a
CVE-2019-10119 CRITICAL 9.8 UPGRADE UPGRADE eQ-3 HomeMatic CCU2 devices before 2.41.8 and CCU3 devices before 3.43.16 use session IDs for authentication b
CVE-2018-7301 CRITICAL 9.8 MITIGATE eQ-3 AG HomeMatic CCU2 2.29.22 devices have an open XML-RPC port without authentication
CVE-2018-7300 CRITICAL 9.8 UPGRADE Directory Traversal / Arbitrary File Write / Remote Code Execution in the User.setLanguage method in eQ-3 AG H
CVE-2018-7299 HIGH 8.0 UPGRADE Remote Code Execution in the addon installation process in eQ-3 AG Homematic CCU2 2.29.2 and earlier allows au
CVE-2018-7298 HIGH 8.1 MITIGATE In /usr/local/etc/config/addons/mh/loopupd.sh on eQ-3 AG HomeMatic CCU2 2.29.22 devices, software update packa
CVE-2018-7297 CRITICAL 9.8 UPGRADE Remote Code Execution in the TCL script interpreter in eQ-3 AG Homematic CCU2 2.29.2 and earlier allows remote
CVE-2018-7296 MEDIUM 5.3 UPGRADE Directory Traversal / Arbitrary File Read in User.getLanguage method in eQ-3 AG Homematic CCU2 2.29.2 and earl

FAQ

How do I fix eq-3 vulnerabilities?

Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.

Is eq-3 being exploited right now?

None of the tracked eq-3 CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.

Which eq-3 CVE should I patch first?

CVE-2021-33032 currently ranks highest (70/100): A Remote Code Execution (RCE) vulnerability in the WebUI component of the eQ-3 HomeMatic CCU2 firmware up to a.

Products

RSS feed for eq-3 · ← Back to latest CVEs