Back to Database
Status published
High
CVE-2019-9727
Unauthenticated password hash disclosure in the User.getUserPWD method in eQ-3...
Vulnerability Description
Unauthenticated password hash disclosure in the User.getUserPWD method in eQ-3 AG Homematic CCU3 3.43.15 and earlier allows remote attackers to retrieve the GUI password hashes of GUI users. This vulnerability can be exploited by unauthenticated attackers with access to the web interface.
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
THREAT MONITOR
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2019-9727
Credits & Attribution
No credits recorded in the NVD database.
References
More from eq-3
View All →CVE-2021-33032
A Remote Code Execution (RCE) vulnerability in the WebUI component...
Critical
10
CVE-2020-12834
eQ-3 Homematic Central Control Unit (CCU)2 through 2.51.6 and CCU3...
Critical
9.8
CVE-2019-9726
Directory Traversal / Arbitrary File Read in eQ-3 AG Homematic...
High
7.5
CVE-2019-9585
eQ-3 Homematic CCU2 prior to 2.47.10 and CCU3 prior to...
Critical
9.8
CVE-2019-9584
eQ-3 Homematic AddOn 'CloudMatic' on CCU2 and CCU3 allows uncontrolled...
Critical
9.8
Affected Vendor
eq-3
View all reports →Affected Software
ccu3 firmware
Vulnerable Versions:
0
Timeline
Official Publish:
May 13th, 2019
Last Modified:
August 4th, 2024
Added to House:
July 20th, 2026
CVSS Vectors
V3:
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weaknesses (CWE)
No CWE data available
MITRE ATT&CK TTPs
No associated TTPs found for this vulnerability.