CVE-2020-12834

critical · 9.8

eQ-3 Homematic Central Control Unit (CCU)2 through 2.51.6 and CCU3 through 3.51.6 allow Remote Code Execution in the JSON API Method ReGa.runScript, by unauthenticated attackers with access to the web interface, due to the default auto-login feature being enabled during first-time setup (or factory reset).

9.8

CVSS

11.1%

EPSS (exploit prob.)

96th

EPSS percentile

2020-05-15

Published

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weaknesses

CWE-276

Affected products

Vendor	Product	Affected versions
eq-3	homematic_ccu2_firmware	<= 2.51.6
eq-3	homematic_ccu2	all versions
eq-3	ccu3_firmware	<= 3.51.6
eq-3	homematic_ccu3	all versions

Check a specific version with /api/v1/cve/match.

References

https://psytester.github.io/CVE-2020-12834/
https://psytester.github.io/CVE-2020-12834/

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2020-12834