CVE-2019-14424

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

A Local File Inclusion (LFI) issue in the addon CUx-Daemon 1.11a of the eQ-3 Homematic CCU-Firmware 2.35.16 until 2.45.6 allows remote authenticated attackers to read sensitive files via a simple HTTP Request.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-22

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://noskill1337.github.io/homematic-with-cux-daemon-local-file-inclusionExploit, Mitigation, Third Party Advisory
https://www.eq-3.com/products/homematic.htmlVendor Advisory
https://noskill1337.github.io/homematic-with-cux-daemon-local-file-inclusionExploit, Mitigation, Third Party Advisory
https://www.eq-3.com/products/homematic.htmlVendor Advisory

Timeline

Published: Oct 17, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-144276.1XSS exists in WEB STUDIO Ultimate Loan Manager 2.0 by adding a branch under the Branches button that sets the notes parameter with crafted J CVE-2019-14436.5An information disclosure vulnerability exists in Microsoft SharePoint when an attacker uploads a specially crafted file to the SharePoint S CVE-2019-144305.3plugin/Audit/Objects/AuditTable.php in YouPHPTube through 7.2 allows SQL Injection.CVE-2019-144319.8In MatrixSSL 3.8.3 Open through 4.2.1 Open, the DTLS server mishandles incoming network messages leading to a heap-based buffer overflow of CVE-2019-144328.8Incorrect authentication of application WebSocket connections in Loom Desktop for Mac up to 0.16.0 allows remote code execution from either CVE-2019-144336.5An issue was discovered in OpenStack Nova before 17.0.12, 18.x before 18.2.2, and 19.x before 19.0.2. If an API request from an authenticate CVE-2019-144377.8The xiph_SplitHeaders function in modules/demux/xiph.h in VideoLAN VLC media player 3.0.7.1 does not check array bounds properly. As a resul CVE-2019-144387.8A heap-based buffer over-read in xiph_PackHeaders() in modules/demux/xiph.h in VideoLAN VLC media player 3.0.7.1 allows remote attackers to CVE-2019-144397.5A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.x before 2.9.9.2. This occurs when Default Typing is enabled (eith CVE-2019-144416.5An issue was discovered in Libav 12.3. An access violation allows remote attackers to cause a denial of service (application crash), as demo CVE-2019-144426.5In mpc8_read_header in libavformat/mpc8.c in Libav 12.3, an input file can result in an avio_seek infinite loop and hang, with 100% CPU cons CVE-2019-144436.5An issue was discovered in Libav 12.3. Division by zero in range_decode_culshift in libavcodec/apedec.c allows remote attackers to cause a d