CVE-2019-18939

Name of the Vulnerable Software and Affected Versions eQ-3 Homematic CCU2 version 2.47.20 eQ-3 Homematic CCU3 version 3.47.18 eQ-3 Homematic HM-Print AddOn versions through 1.2a

Description The issue allows remote code execution by unauthenticated attackers with access to the web interface. This is achieved via the exec.cgi and exec1.cgi scripts, which execute TCL script content from an HTTP POST request.

Recommendations For eQ-3 Homematic CCU2 version 2.47.20, update to a version that fixes the remote code execution issue. For eQ-3 Homematic CCU3 version 3.47.18, update to a version that fixes the remote code execution issue. For eQ-3 Homematic HM-Print AddOn versions through 1.2a, update to a version that fixes the remote code execution issue. As a temporary workaround, consider restricting access to the exec.cgi and exec1.cgi scripts to minimize the risk of exploitation.