High severity8.1NVD Advisory· Published Aug 13, 2019· Updated Jun 17, 2026

CVE-2019-14984

Description

eQ-3 Homematic CCU2 and CCU3 with the XML-API through 1.2.0 AddOn installed allow Remote Code Execution by unauthenticated attackers with access to the web interface, because the undocumented addons/xmlapi/exec.cgi script uses CMD_EXEC to execute TCL code from a POST request.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

eQ-3/Homematic Ccu2 Firmware
cpe:2.3:o:eq-3:homematic_ccu2_firmware:*:*:*:*:*:*:*:*
Range: <=1.2.0
eQ-3/Homematic Ccu3 Firmware
cpe:2.3:o:eq-3:homematic_ccu3_firmware:*:*:*:*:*:*:*:*
Range: <=1.2.0
eQ-3/Homematic CCU2 and CCU3 with the XML-APIdescription
eQ-3/Homematic CCU2llm-fuzzy
Range: <=1.2.0

Patches

Vulnerability mechanics

References

psytester.github.io/CVE-2019-14984/nvdExploitThird Party Advisory

News mentions

No linked articles in our index yet.

cvss	0.526
epss	0.005
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000