CVE-2019-18938
Summary
| CVE | CVE-2019-18938 |
|---|---|
| State | PUBLIC |
| Assigner | [email protected] |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2019-11-14 19:15:00 UTC |
| Updated | 2021-07-21 11:39:00 UTC |
| Description | eQ-3 Homematic CCU2 2.47.20 and CCU3 3.47.18 with the E-Mail AddOn through 1.6.8.c installed allow Remote Code Execution by unauthenticated attackers with access to the web interface via the save.cgi script for payload upload and the testtcl.cgi script for its execution. |
Risk And Classification
Problem Types: CWE-306
NVD Known Affected Configurations (CPE 2.3)
| Type | Vendor | Product | Version | Update | Edition | Language |
|---|---|---|---|---|---|---|
| Hardware | Eq-3 | Homematic Ccu2 | - | All | All | All |
| Hardware | Eq-3 | Homematic Ccu2 | - | All | All | All |
| Operating System | Eq-3 | Homematic Ccu2 Firmware | 2.24.20 | All | All | All |
| Operating System | Eq-3 | Homematic Ccu2 Firmware | 2.24.20 | All | All | All |
| Hardware | Eq-3 | Homematic Ccu3 | - | All | All | All |
| Hardware | Eq-3 | Homematic Ccu3 | - | All | All | All |
| Operating System | Eq-3 | Homematic Ccu3 Firmware | 3.47.18 | All | All | All |
| Operating System | Eq-3 | Homematic Ccu3 Firmware | 3.47.18 | All | All | All |
| Application | Hm Email Project | Hm Email | 1.6.0 | All | All | All |
| Application | Hm Email Project | Hm Email | 1.6.2 | All | All | All |
| Application | Hm Email Project | Hm Email | 1.6.3 | All | All | All |
| Application | Hm Email Project | Hm Email | 1.6.4 | All | All | All |
| Application | Hm Email Project | Hm Email | 1.6.5 | All | All | All |
| Application | Hm Email Project | Hm Email | 1.6.6 | All | All | All |
| Application | Hm Email Project | Hm Email | 1.6.7 | All | All | All |
| Application | Hm Email Project | Hm Email | 1.6.7a | All | All | All |
| Application | Hm Email Project | Hm Email | 1.6.7b | All | All | All |
| Application | Hm Email Project | Hm Email | 1.6.7c | All | All | All |
| Application | Hm Email Project | Hm Email | 1.6.8 | All | All | All |
| Application | Hm Email Project | Hm Email | 1.6.8a | All | All | All |
| Application | Hm Email Project | Hm Email | 1.6.8b | All | All | All |
| Application | Hm Email Project | Hm Email | 1.6.8c | All | All | All |
| Application | Hm Email Project | Hm Email | 1.6.0 | All | All | All |
| Application | Hm Email Project | Hm Email | 1.6.2 | All | All | All |
| Application | Hm Email Project | Hm Email | 1.6.3 | All | All | All |
| Application | Hm Email Project | Hm Email | 1.6.4 | All | All | All |
| Application | Hm Email Project | Hm Email | 1.6.5 | All | All | All |
| Application | Hm Email Project | Hm Email | 1.6.6 | All | All | All |
| Application | Hm Email Project | Hm Email | 1.6.7 | All | All | All |
| Application | Hm Email Project | Hm Email | 1.6.7a | All | All | All |
| Application | Hm Email Project | Hm Email | 1.6.7b | All | All | All |
| Application | Hm Email Project | Hm Email | 1.6.7c | All | All | All |
| Application | Hm Email Project | Hm Email | 1.6.8 | All | All | All |
| Application | Hm Email Project | Hm Email | 1.6.8a | All | All | All |
| Application | Hm Email Project | Hm Email | 1.6.8b | All | All | All |
| Application | Hm Email Project | Hm Email | 1.6.8c | All | All | All |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| CVE-2019-18938 eQ-3 Homematic AddOn 'E-Mail' version 1.6.8.c and prior on CCU2 and CCU3 allows Remote Code Execution by unauthenticated attackers with access to the web interface by usage of the save.cgi script for payload upload and the testtcl.cgi script for its execution – psytester – Testing is my passion. Sharing knowledge is my contribution. | MISC | psytester.github.io | Exploit, Third Party Advisory |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
No vendor comments have been submitted for this CVE.
There are currently no legacy QID mappings associated with this CVE.