CVE-2019-13030

eQ-3 Homematic CCU3 AddOn 'Mediola NEO Server for Homematic CCU3' prior to 2.4.5 allows uncontrolled admin access to start or stop the Node.js process, resulting in the ability to obtain mediola configuration details. This is related to improper access control for addons configuration pages and a missing check in rc.d/97NeoServer.

• CWE-425

• https://github.com/psytester/psytester.github.io/blob/master/_posts/hacking_and_pentests/CVEs/2019-06-29-CVE-2019-13030.mdExploit, Third Party Advisory
• https://psytester.github.io/CVE-2019-13030/Exploit, Third Party Advisory
• https://github.com/psytester/psytester.github.io/blob/master/_posts/hacking_and_pentests/CVEs/2019-06-29-CVE-2019-13030.mdExploit, Third Party Advisory
• https://psytester.github.io/CVE-2019-13030/Exploit, Third Party Advisory

Published

Aug 14, 2019

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2019-13025Compal CH7465LG CH7465LG-NCIP-6.12.18.24-5p8-NOSH devices ha…9.8
• CVE-2019-13026OXID eShop 6.0.x before 6.0.5 and 6.1.x before 6.1.4 allows …
• CVE-2019-13027Realization Concerto Critical Chain Planner (aka CCPM) 5.10.…
• CVE-2019-13028An incorrect implementation of a local web server in eID cli…
• CVE-2019-13029Multiple stored Cross-site scripting (XSS) issues in the adm…
• CVE-2019-1303An elevation of privilege vulnerability exists when the Wind…7.8
• CVE-2019-13031LemonLDAP::NG before 1.9.20 has an XML External Entity (XXE)…
• CVE-2019-13032An issue was discovered in FlightCrew v0.9.2 and earlier. A …
• CVE-2019-13033In CISOfy Lynis 2.x through 2.7.5, the license key can be ob…3.3
• CVE-2019-13035Artica Pandora FMS 7.0 NG before 735 suffers from local priv…
• CVE-2019-13038mod_auth_mellon through 0.14.2 has an Open Redirect via the …6.1
• CVE-2019-1304Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…