Sign-up

ID

VAR-201909-0592


CVE

CVE-2019-16199


TITLE

eQ-3 Homematic CCU2 and CCU3 Authentication vulnerability

Trust: 0.8

sources: JVNDB: JVNDB-2019-009441

DESCRIPTION

eQ-3 Homematic CCU2 before 2.47.18 and CCU3 before 3.47.18 allow Remote Code Execution by unauthenticated attackers with access to the web interface via an HTTP POST request to certain URLs related to the ReGa core process. eQ-3 Homematic CCU2 and CCU3 Contains an authentication vulnerability.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state

Trust: 1.62

sources: NVD: CVE-2019-16199 // JVNDB: JVNDB-2019-009441

AFFECTED PRODUCTS

vendor:eq 3model:homematic ccu2scope:ltversion:2.47.18

Trust: 1.0

vendor:eq 3model:homematic ccu3scope:ltversion:3.47.18

Trust: 1.0

vendor:eq 3model:ccu2scope:ltversion:2.47.18

Trust: 0.8

vendor:eq 3model:ccu3scope:ltversion:3.47.18

Trust: 0.8

sources: JVNDB: JVNDB-2019-009441 // NVD: CVE-2019-16199

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2019-16199
value: CRITICAL

Trust: 1.0

NVD: CVE-2019-16199
value: CRITICAL

Trust: 0.8

CNNVD: CNNVD-201909-844
value: CRITICAL

Trust: 0.6

nvd@nist.gov: CVE-2019-16199
severity: HIGH
baseScore: 7.5
vectorString: AV:N/AC:L/AU:N/C:P/I:P/A:P
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 10.0
impactScore: 6.4
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.8

nvd@nist.gov: CVE-2019-16199
baseSeverity: CRITICAL
baseScore: 9.8
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: 3.9
impactScore: 5.9
version: 3.1

Trust: 1.0

NVD: CVE-2019-16199
baseSeverity: CRITICAL
baseScore: 9.8
vectorString: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: NONE
impactScore: NONE
version: 3.0

Trust: 0.8

sources: JVNDB: JVNDB-2019-009441 // CNNVD: CNNVD-201909-844 // NVD: CVE-2019-16199

PROBLEMTYPE DATA

problemtype:CWE-306

Trust: 1.0

problemtype:CWE-287

Trust: 0.8

sources: JVNDB: JVNDB-2019-009441 // NVD: CVE-2019-16199

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-201909-844

TYPE

access control error

Trust: 0.6

sources: CNNVD: CNNVD-201909-844

CONFIGURATIONS

sources:
            
            
            JVNDB: JVNDB-2019-009441

PATCH
title:Top Pageurl:https://www.eq-3.com/
Trust: 0.8
title:eQ-3 HomeMatic CCU2  and eQ-3 Homematic CCU3 Security vulnerabilitiesurl:http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=98372
Trust: 0.6
sources:
            
            
            JVNDB: JVNDB-2019-009441 // 
            
            
            
            CNNVD: CNNVD-201909-844

EXTERNAL IDS
db:NVDid:CVE-2019-16199
Trust: 2.4
db:JVNDBid:JVNDB-2019-009441
Trust: 0.8
db:CNNVDid:CNNVD-201909-844
Trust: 0.6
sources:
            
            
            JVNDB: JVNDB-2019-009441 // 
            
            
            
            CNNVD: CNNVD-201909-844 // 
            
            
            
            NVD: CVE-2019-16199

REFERENCES
url:https://psytester.github.io/cve-2019-16199/
Trust: 2.4
url:https://nvd.nist.gov/vuln/detail/cve-2019-16199
Trust: 1.4
url:https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2019-16199
Trust: 0.8
sources:
            
            
            JVNDB: JVNDB-2019-009441 // 
            
            
            
            CNNVD: CNNVD-201909-844 // 
            
            
            
            NVD: CVE-2019-16199

SOURCES
db:JVNDBid:JVNDB-2019-009441
db:CNNVDid:CNNVD-201909-844
db:NVDid:CVE-2019-16199

LAST UPDATE DATE
2024-11-23T22:44:53.857000+00:00

SOURCES UPDATE DATE
db:JVNDBid:JVNDB-2019-009441date:2019-09-20T00:00:00
db:CNNVDid:CNNVD-201909-844date:2020-08-25T00:00:00
db:NVDid:CVE-2019-16199date:2024-11-21T04:30:15.433

SOURCES RELEASE DATE
db:JVNDBid:JVNDB-2019-009441date:2019-09-20T00:00:00
db:CNNVDid:CNNVD-201909-844date:2019-09-17T00:00:00
db:NVDid:CVE-2019-16199date:2019-09-17T21:15:11.163