{"id":"CVE-2019-14986","aliases":["EUVD-2019-6075","GHSA-8f74-5qhp-5pxg"],"status":"published","title":"eQ-3 Homematic CCU2 and CCU3 with the CUxD AddOn before 2.3.0 installed allow administrative...","description":"eQ-3 Homematic CCU2 and CCU3 with the CUxD AddOn before 2.3.0 installed allow administrative operations by unauthenticated attackers with access to the web interface, because features such as File-Browser and Shell Command (as well as \"Set root password\") are exposed.","severity":{"version":"3.0","score":8.1,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-10","score":0.02531,"percentile":0.85054,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"published":"2019-08-13T19:19:44Z","modified":"2026-06-17T02:19:27Z","products":[{"vendor":"eq-3","product":"homematic_ccu2_firmware"},{"vendor":"eq-3","product":"homematic_ccu3_firmware"}],"references":[{"url":"https://psytester.github.io/CVE-2019-14986/","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-14986"},{"url":"https://psytester.github.io/CVE-2019-14986"},{"url":"https://github.com/advisories/GHSA-8f74-5qhp-5pxg"}],"sources":{"cve":[{"id":"CVE-2019-14986","description":"eQ-3 Homematic CCU2 and CCU3 with the CUxD AddOn before 2.3.0 installed allow administrative operations by unauthenticated attackers with access to the web interface, because features such as File-Browser and Shell Command (as well as \"Set root password\") are exposed.","status":"published","published":"2019-08-13T19:19:44Z","modified":"2024-08-05T00:34:53.132Z","updated_at":"2026-11-02T14:20:18.085548Z"}],"euvd":[{"id":"EUVD-2019-6075","description":"eQ-3 Homematic CCU2 and CCU3 with the CUxD AddOn before 2.3.0 installed allow administrative operations by unauthenticated attackers with access to the web interface, because features such as File-Browser and Shell Command (as well as \"Set root password\") are exposed.","status":"published","published":"2019-08-13T19:19:44Z","modified":"2024-08-05T00:34:53Z","updated_at":"2026-11-03T02:40:37.624691Z"}],"ghsa":[{"id":"GHSA-8f74-5qhp-5pxg","title":"eQ-3 Homematic CCU2 and CCU3 with the CUxD AddOn before 2.3.0 installed allow administrative...","description":"eQ-3 Homematic CCU2 and CCU3 with the CUxD AddOn before 2.3.0 installed allow administrative operations by unauthenticated attackers with access to the web interface, because features such as File-Browser and Shell Command (as well as \"Set root password\") are exposed.","status":"published","published":"2022-05-24T16:53:16Z","modified":"2024-04-11T21:08:49Z","cvss":[{"version":"3.0","score":8.1,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T14:57:07.421443Z"}],"nvd":[{"id":"CVE-2019-14986","description":"eQ-3 Homematic CCU2 and CCU3 with the CUxD AddOn before 2.3.0 installed allow administrative operations by unauthenticated attackers with access to the web interface, because features such as File-Browser and Shell Command (as well as \"Set root password\") are exposed.","status":"published","published":"2019-08-13T20:15:12.307Z","modified":"2026-06-17T02:19:27.337Z","cvss":[{"version":"3.0","score":8.1,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":9.3,"vector":"AV:N/AC:M/Au:N/C:C/I:C/A:C","level":"high","assessor":"primary"}],"updated_at":"2026-11-02T14:05:22.878504Z"}]}}