What’s Vulnerable › Vulnerabilities

CVE-2019-15849

• Severity: high (CVSS 7.3 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.8% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2019-10-17 · updated 2026-06-17
• Weakness: CWE-384

Description

eQ-3 HomeMatic CCU3 firmware 3.41.11 allows session fixation. An attacker can create session IDs and send them to the victim. After the victim logs in to the session, the attacker can use that session. The attacker could create SSH logins after a valid session and easily compromise the system.

Affected products

• Eq-3 Homematic Ccu3 Firmware: 3.14.11

References

• https://noskill1337.github.io/homematic-ccu3-session-fixation
• https://www.eq-3.com/products/homematic.html
• https://noskill1337.github.io/homematic-ccu3-session-fixation
• https://www.eq-3.com/products/homematic.html

Get alerted when CVE-2019-15849 or the next vulnerability affects your stack