CVE-2019-10119 | BDVDB-2026-118976 Detail

Description#

eQ-3 HomeMatic CCU2 devices before 2.41.8 and CCU3 devices before 3.43.16 use session IDs for authentication but lack authorization checks. An attacker can obtain a session ID via an invalid login attempt to the RemoteApi account, aka HMCCU-154. This leads to automatic login as admin.

Impact#

Weaknesses#

References#

Exploit#

History#

1. Version 12019-07-10Record published in the CVE List.
2. Version 22024-08-04Most recent update recorded in the CVE List.