CVE-2019-18938 : Security Advisory and Response

The eQ-3 Homematic CCU2 and CCU3 with specific versions and E-Mail AddOn are vulnerable to remote code execution.

Understanding CVE-2019-18938

This CVE describes a vulnerability in eQ-3 Homematic CCU2 and CCU3 that allows unauthenticated attackers to execute remote code.

What is CVE-2019-18938?

The eQ-3 Homematic CCU2 version 2.47.20 and CCU3 version 3.47.18, with the E-Mail AddOn up to 1.6.8.c installed, have a vulnerability that enables unauthenticated attackers to execute remote code through specific scripts.

The Impact of CVE-2019-18938

This vulnerability allows attackers to upload payloads and execute them through the web interface, potentially leading to unauthorized remote code execution.

Technical Details of CVE-2019-18938

The following technical details outline the specifics of this vulnerability.

Vulnerability Description

The vulnerability in eQ-3 Homematic CCU2 and CCU3 allows unauthenticated attackers to upload and execute payloads via the web interface.

Affected Systems and Versions

eQ-3 Homematic CCU2 version 2.47.20
eQ-3 Homematic CCU3 version 3.47.18
E-Mail AddOn up to version 1.6.8.c

Exploitation Mechanism

Attackers can exploit this vulnerability using the save.cgi script for payload upload and the testtcl.cgi script for executing the payload.

Mitigation and Prevention

Protect your systems from CVE-2019-18938 with the following measures.

Immediate Steps to Take

Disable remote access if not required
Apply vendor-supplied patches promptly
Monitor network traffic for suspicious activities

Long-Term Security Practices

Regularly update and patch all software and firmware
Implement network segmentation to limit the attack surface

Patching and Updates

Ensure all affected systems are updated with the latest patches to mitigate the risk of remote code execution.