CVE-2019-10120
N/A
Published: July 10, 2019 at 11:47 AM UTC
Updated: June 17, 2026 at 02:10 AM UTC
4 products affected across 1 vendorCCU3 FirmwareCCU2 FirmwareCcu3
Using N/A by N/A?
Get instant alerts when new vulnerabilities affect N/A - before attackers find them.
Real-time alertsTrack your software stackFree plan available
Severity
N/A
Exploit prediction
EPSS 1%
Description
On eQ-3 HomeMatic CCU2 devices before 2.41.8 and CCU3 devices before 3.43.16, automatic login configuration (aka setAutoLogin) can be achieved by continuing to use a session ID after a logout, aka HMCCU-154.
Affected
Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.
v < 2.41.8
Affected range stops below 2.41.8, so it looks safe — our inference, not a vendor statement
eq-3-ccu2 (same device)
v < 3.43.16
Affected range stops below 3.43.16, so it looks safe — our inference, not a vendor statement
eq-3-ccu3 (same device)
Remediation
No guide yetNo remediation guidance has been written for this CVE yet. What the record does show:
References (2)
x_refsource_MISCRelease NotesVendor Advisory
Source: [email protected]
https://www.eq-3.de/Downloads/Software/CCU3-Firmware/CCU3-3.43.16/CCU3-Changelog.3.43.16.pdfx_refsource_MISCRelease NotesVendor Advisory
Source: [email protected]
https://www.eq-3.de/Downloads/Software/HM-CCU2-Firmware_Updates/HM-CCU-2.41.9/HM-CCU2-Changelog.2.41.9.pdfQuick Info
StatusMODIFIED
CWE
CWE-384
Get alerted
Stop reading CVE feeds looking for your own stack
Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.
Free plan, no card