CVE-2019-10119

CVE-2019-10119 describes a critical authentication bypass vulnerability affecting eQ-3 HomeMatic CCU2 devices before version 2.41.8 and CCU3 devices before version 3.43.16. An attacker can obtain a valid session ID through an invalid login attempt to the RemoteApi account, leading to an automatic administrative login due to a lack of authorization checks. This vulnerability carries a CVSS score of 9.8 (Critical), indicating a high potential for complete compromise of confidentiality, integrity, and availability, with no user interaction or authentication required. While the FAUCET Risk Score is 78/100, there is currently no evidence of active exploitation, public exploit code (Metasploit, Nuclei, ExploitDB), or significant community discussion or media coverage.