CVE-2019-9585: Eq-3 Homematic CCU2 Firmware

Critical severity, CVSS 9.8. EPSS: 2.7% chance of exploitation in the next 30 days.

eQ-3 Homematic CCU2 prior to 2.47.10 and CCU3 prior to 3.47.10 JSON API has Improper Access Control for Interface.***Metadata related operations, resulting in the ability to read, set and deletion of Metadata.

Affected products

• Eq-3 Homematic CCU2 Firmware: before 2.47.10 (fixed in 2.47.10)
• Eq-3 Homematic CCU3 Firmware: before 3.47.10 (fixed in 3.47.10)

Published 2019-08-14. Last modified 2026-06-17.