What’s Vulnerable › Vulnerabilities

CVE-2019-14424

• Severity: medium (CVSS 6.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.4% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2019-10-17 · updated 2026-06-17
• Weakness: CWE-22

Description

A Local File Inclusion (LFI) issue in the addon CUx-Daemon 1.11a of the eQ-3 Homematic CCU-Firmware 2.35.16 until 2.45.6 allows remote authenticated attackers to read sensitive files via a simple HTTP Request.

Affected products

• Eq-3 Ccu2 Firmware: from 2.35.16 through 2.45.6
• Eq-3 Cux-Daemon: from 1.11a through 2.2.0

References

• https://noskill1337.github.io/homematic-with-cux-daemon-local-file-inclusion
• https://www.eq-3.com/products/homematic.html
• https://noskill1337.github.io/homematic-with-cux-daemon-local-file-inclusion
• https://www.eq-3.com/products/homematic.html

Get alerted when CVE-2019-14424 or the next vulnerability affects your stack