PT-2020-13281
CVE-2020-12834
·
تاريخ النشر
2020-05-15
·
تاريخ التحديث
2020-05-21
الوصف من
CVSS 3.1
9.8
حرجةالمقاييسAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions
eQ-3 Homematic Central Control Unit (CCU) versions 2 through 2.51.6
eQ-3 Homematic Central Control Unit (CCU3) versions 3 through 3.51.6
Description
The issue allows Remote Code Execution in the JSON API Method
ReGa.runScript, by unauthenticated attackers with access to the web interface, due to the default auto-login feature being enabled during first-time setup or factory reset.Recommendations
For eQ-3 Homematic Central Control Unit (CCU) versions 2 through 2.51.6, disable the default auto-login feature to prevent exploitation.
For eQ-3 Homematic Central Control Unit (CCU3) versions 3 through 3.51.6, disable the default auto-login feature to prevent exploitation.
As a temporary workaround, consider disabling the
ReGa.runScript method until a patch is available.قابلية الاستغلال
استغلال
إصلاح
التأثيرات
الباحثون
المورّدون
المنتجات المتأثرة
وجدت خطأً في الوصف؟ لديك ما تضيفه؟ لا تتردد في مراسلتنا 👾