CVE-2019-14475 Missing authorization in n/a
Attackers can bypass authorization to read messages, modify system protocols, and create users on HomeMatic CCU devices.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2019-14475?
CVE-2019-14475 is a high-severity missing authorization vulnerability in n/a, published on 5 Aug 2019. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
eQ-3 Homematic CCU2 2.47.15 and prior and CCU3 3.47.15 and prior use session IDs for authentication but lack authorization checks. An attacker can obtain a session ID from CVE-2019-9583, resulting in the ability to read the service messages, clear the system protocol, create a new user in the system, or modify/delete internal programs.
Weakness: CWE-862
Which versions are affected by CVE-2019-14475?
It affects 2 products.
Products include Eq-3 Ccu2 Firmware, Eq-3 Ccu3 Firmware.
How do I fix CVE-2019-14475?
No fix has been published for CVE-2019-14475 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2019-14475 being exploited?
There is no known exploitation of CVE-2019-14475 in the wild and no public exploit code.
Other vulnerabilities in n/a
Sources
Also known as GHSA-943c-f2xw-gmr9.