TI-2018-05295 CVE-2018-7301 · GHSA-x5g4-5xch-2jmm
eQ-3 AG HomeMatic CCU2 2.29.22 devices have an open XML-RPC port without authentication.
Priority MEDIUM 45
eQ-3 AG HomeMatic CCU2 2.29.22 devices have an open XML-RPC port without authentication.
Vulnerabilities
5 records
TI-2018-05293 CVE-2018-7299 · GHSA-wv49-cr33-qx55
Remote Code Execution in the addon installation process in eQ-3 AG Homematic CCU2 2.29.2…
Priority LOW 37
Remote Code Execution in the addon installation process in eQ-3 AG Homematic CCU2 2.29.2 and earlier allows authenticated attackers to create or overwrite arbitrary files or install malicious software on the device.
TI-2018-05292 CVE-2018-7298 · GHSA-xv6q-9vrg-6p5g
In /usr/local/etc/config/addons/mh/loopupd.sh on eQ-3 AG HomeMatic CCU2 2.29.22 devices…
Priority LOW 37
In /usr/local/etc/config/addons/mh/loopupd.sh on eQ-3 AG HomeMatic CCU2 2.29.22 devices, software update packages are downloaded via the HTTP protocol, which does not provide any cryptographic protection of the downloade…
TI-2018-05291 CVE-2018-7297 · GHSA-q64h-3pq3-w59f
Remote Code Execution in the TCL script interpreter in eQ-3 AG Homematic CCU2 2.29.2 and…
Priority HIGH 78
Remote Code Execution in the TCL script interpreter in eQ-3 AG Homematic CCU2 2.29.2 and earlier allows remote attackers to obtain read/write access and execute system commands on the device.
TI-2018-05290 CVE-2018-7296 · GHSA-xhgp-9mrx-4vxr
Directory Traversal / Arbitrary File Read in User.getLanguage method in eQ-3 AG Homematic…
Priority LOW 28
Directory Traversal / Arbitrary File Read in User.getLanguage method in eQ-3 AG Homematic CCU2 2.29.2 and earlier allows remote attackers to read the first line of an arbitrary file on the CCU2's filesystem.