CVE-2019-18937

Name of the Vulnerable Software and Affected Versions eQ-3 Homematic CCU2 version 2.47.20 eQ-3 Homematic CCU3 version 3.47.18

Description The issue allows remote code execution by unauthenticated attackers with access to the web interface. This is achieved via the exec.cgi script, which executes TCL script content from an HTTP POST request.

Recommendations For eQ-3 Homematic CCU2 version 2.47.20, update the system to remove or restrict access to the exec.cgi script to prevent remote code execution. For eQ-3 Homematic CCU3 version 3.47.18, update the system to remove or restrict access to the exec.cgi script to prevent remote code execution. As a temporary workaround, consider disabling the Script Parser AddOn until a patch is available.