What’s Vulnerable › Vulnerabilities

CVE-2019-14985

• Severity: critical (CVSS 9.8 v3.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 7.5% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2019-08-13 · updated 2026-06-17
• Weakness: CWE-287

Description

eQ-3 Homematic CCU2 and CCU3 with the CUxD AddOn installed allow Remote Code Execution by unauthenticated attackers with access to the web interface, because this interface can access the CMD_EXEC virtual device type 28.

Affected products

• Eq-3 Homematic Ccu2 Firmware: 2.35.16, 2.41.5, 2.41.8, 2.41.9, 2.45.6, 2.45.7 (+3)
• Eq-3 Homematic Ccu3 Firmware: 3.41.11, 3.43.16, 3.45.5, 3.45.7, 3.47.10, 3.47.15

References

• https://psytester.github.io/CVE-2019-14985/
• https://psytester.github.io/CVE-2019-14985/

Get alerted when CVE-2019-14985 or the next vulnerability affects your stack