CVE-2019-9726

HIGHNuclei

Homematic CCU3 - Local File Inclusion

Title source: github.com
STIX 2.1 vulnerability

Record summary

CVE-2019-9726 has a selected CVSS score of 7.5 (high); EIP currently links 1 Nuclei template.

Description

Directory Traversal / Arbitrary File Read in eQ-3 AG Homematic CCU3 3.43.15 and earlier allows remote attackers to read arbitrary files of the device's filesystem. This vulnerability can be exploited by unauthenticated attackers with access to the web interface.

Description source: CVE List

Exploitation context

Available material

Nuclei templates
1

Nuclei templates

1
ProjectDiscoveryHIGHHomematic CCU3 - Local File InclusionCVSS 7.5

eQ-3 AG Homematic CCU3 3.43.15 and earlier allows remote attackers to read arbitrary files of the device's filesystem, aka local file inclusion. This vulnerability can be exploited by unauthenticated attackers with access to the web interface.

Impact

An attacker can exploit this vulnerability to read sensitive files on the system.

Remediation

Apply the latest security patches or updates provided by the vendor.

WeaknessesCWE-22
Authors0x_Akoko
Template tagscve2019cvehomematiclfieq-3vuln
CVSS vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CPE: cpe:2.3:o:eq-3:ccu3_firmware:*:*:*:*:*:*:*:*
https://atomic111.github.io/article/homematic-ccu3-fileread https://nvd.nist.gov/vuln/detail/CVE-2019-9726 https://github.com/ARPSyndicate/kenzer-templates

Source: ProjectDiscovery

References

2