CVE-2019-9583

moderate-risk
Published 2019-08-14

eQ-3 Homematic CCU2 and CCU3 obtain session IDs without login. This allows a Denial of Service and is a starting point for other attacks. Affected versions for CCU2: 2.35.16, 2.41.5, 2.41.8, 2.41.9, 2.45.6, 2.45.7, 2.47.10, 2.47.12, 2.47.15. Affected versions for CCU3: 3.41.11, 3.43.16, 3.45.5, 3.45.7, 3.47.10, 3.47.15.

Do I need to act?

-
0.15% chance of exploitation
EPSS score — low exploit probability
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
8
CVSS 8.2/10 High
NETWORK / LOW complexity

Affected Products (16)

Affected Vendors

Eq-3

References (4)

Exploit https://github.com/psytester/psytester.github.io/blob/master/_posts/hacking_and_...
Exploit https://psytester.github.io/CVE-2019-9583/
Exploit https://github.com/psytester/psytester.github.io/blob/master/_posts/hacking_and_...
Exploit https://psytester.github.io/CVE-2019-9583/
47
/ 100
moderate-risk
Severity 28/34 · Critical
Exploitability 1/34 · Minimal
Exposure 18/34 · Moderate