Vulnerabilities > EQ 3 > High
| DATE | CVE | VULNERABILITY TITLE | RISK |
|---|---|---|---|
| 2019-07-10 | CVE-2019-10120 | Session Fixation vulnerability in Eq-3 Ccu2 Firmware and Ccu3 Firmware On eQ-3 HomeMatic CCU2 devices before 2.41.8 and CCU3 devices before 3.43.16, automatic login configuration (aka setAutoLogin) can be achieved by continuing to use a session ID after a logout, aka HMCCU-154. | 8.8 |
| 2019-05-13 | CVE-2019-9727 | Missing Authentication for Critical Function vulnerability in Eq-3 Ccu3 Firmware Unauthenticated password hash disclosure in the User.getUserPWD method in eQ-3 AG Homematic CCU3 3.43.15 and earlier allows remote attackers to retrieve the GUI password hashes of GUI users. | 7.5 |
| 2019-05-13 | CVE-2019-9726 | Path Traversal vulnerability in Eq-3 Ccu3 Firmware Directory Traversal / Arbitrary File Read in eQ-3 AG Homematic CCU3 3.43.15 and earlier allows remote attackers to read arbitrary files of the device's filesystem. | 7.5 |
| 2018-02-22 | CVE-2018-7299 | Unspecified vulnerability in Eq-3 Homematic Central Control Unit Ccu2 Firmware 2.29.22 Remote Code Execution in the addon installation process in eQ-3 AG Homematic CCU2 2.29.2 and earlier allows authenticated attackers to create or overwrite arbitrary files or install malicious software on the device. low complexity eq-3 | 8.0 |
| 2018-02-22 | CVE-2018-7298 | Cleartext Transmission of Sensitive Information vulnerability in Eq-3 Homematic Central Control Unit Ccu2 Firmware 2.29.22 In /usr/local/etc/config/addons/mh/loopupd.sh on eQ-3 AG HomeMatic CCU2 2.29.22 devices, software update packages are downloaded via the HTTP protocol, which does not provide any cryptographic protection of the downloaded contents. | 8.1 |