CVE-2020-12834

Name of the Vulnerable Software and Affected Versions eQ-3 Homematic Central Control Unit (CCU) versions 2 through 2.51.6 eQ-3 Homematic Central Control Unit (CCU3) versions 3 through 3.51.6

Description The issue allows Remote Code Execution in the JSON API Method ReGa.runScript, by unauthenticated attackers with access to the web interface, due to the default auto-login feature being enabled during first-time setup or factory reset.

Recommendations For eQ-3 Homematic Central Control Unit (CCU) versions 2 through 2.51.6, disable the default auto-login feature to prevent exploitation. For eQ-3 Homematic Central Control Unit (CCU3) versions 3 through 3.51.6, disable the default auto-login feature to prevent exploitation. As a temporary workaround, consider disabling the ReGa.runScript method until a patch is available.