CVE-2019-18938

Vulnerability

The E-Mail AddOn version 1.6.8.c and prior for eQ-3 Homematic CCU2 firmware 2.47.20 and CCU3 firmware 3.47.18 contains an improper access control vulnerability (CWE-284) [1]. The save.cgi script allows unauthenticated file uploads, and the testtcl.cgi script executes uploaded Tcl scripts without authentication, enabling remote code execution.

Exploitation

An unauthenticated attacker with network access to the CCU web interface can upload a malicious Tcl script via save.cgi and then trigger its execution by calling testtcl.cgi [1]. No prior authentication or user interaction is required.

Impact

Successful exploitation yields remote code execution on the CCU device with the privileges of the web server process, typically root [1]. This allows full compromise of the smart home controller, including control of connected devices, data exfiltration, and potential lateral movement.

Mitigation

The E-Mail AddOn developer released version 1.7.0 on 2020-11-04, which addresses the vulnerability [1]. Users should update to 1.7.0 or later. The vendor eQ-3 stated they are not responsible for AddOn security [1]. No workaround is documented. This CVE is not listed on the CISA Known Exploited Vulnerabilities catalog.