CVE-2019-9584

eQ-3 Homematic AddOn 'CloudMatic' on CCU2 and CCU3 allows uncontrolled admin access, resulting in the ability to obtain VPN profile details, shutting down the VPN service and to delete the VPN service configuration. This is related to improper access control for all /addons/mh/ pages.

• CWE-425

• https://github.com/psytester/psytester.github.io/blob/master/_posts/hacking_and_pentests/CVEs/2019-03-27-CVE-2019-9584.mdExploit, Third Party Advisory
• https://psytester.github.io/CVE-2019-9584/Exploit, Third Party Advisory
• https://github.com/psytester/psytester.github.io/blob/master/_posts/hacking_and_pentests/CVEs/2019-03-27-CVE-2019-9584.mdExploit, Third Party Advisory
• https://psytester.github.io/CVE-2019-9584/Exploit, Third Party Advisory

Published

Aug 14, 2019

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2019-9578In devs.c in Yubico libu2f-host before 1.1.8, the response t…
• CVE-2019-9579An issue was discovered in Illumos in Nexenta NexentaStor 4.…8.1
• CVE-2019-9580In st2web in StackStorm Web UI before 2.9.3 and 2.10.x befor…
• CVE-2019-9581phpscheduleit Booked Scheduler 2.7.5 allows arbitrary file u…8.8
• CVE-2019-9582eQ-3 Homematic CCU2 outdated base software packages allows D…
• CVE-2019-9583eQ-3 Homematic CCU2 and CCU3 obtain session IDs without logi…8.2
• CVE-2019-9585eQ-3 Homematic CCU2 prior to 2.47.10 and CCU3 prior to 3.47.…
• CVE-2019-9587There is a stack consumption issue in md5Round1() located in…
• CVE-2019-9588There is an Invalid memory access in gAtomicIncrement() loca…
• CVE-2019-9589There is a NULL pointer dereference vulnerability in PSOutpu…
• CVE-2019-9590An issue was discovered on TENGCONTROL T-920 PLC v5.5 device…
• CVE-2019-9591A reflected Cross-site scripting (XSS) vulnerability in Shor…6.1