CVE-2019-9726

high · 7.5

A public exploit / detection template exists

Weaponised detection is publicly available, which meaningfully raises real-world risk regardless of CVSS. nuclei-templates →

Directory Traversal / Arbitrary File Read in eQ-3 AG Homematic CCU3 3.43.15 and earlier allows remote attackers to read arbitrary files of the device's filesystem. This vulnerability can be exploited by unauthenticated attackers with access to the web interface.

7.5

CVSS

16.3%

EPSS (exploit prob.)

97th

EPSS percentile

2019-05-13

Published

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weaknesses

CWE-22

Affected products

Vendor	Product	Affected versions
eq-3	ccu3_firmware	<= 3.43.15
eq-3	ccu3	all versions

Check a specific version with /api/v1/cve/match.

References

https://atomic111.github.io/article/homematic-ccu3-fileread
https://atomic111.github.io/article/homematic-ccu3-fileread

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2019-9726