CVE-2019-10121

CVE-2019-10121 describes a critical authentication bypass vulnerability in eQ-3 HomeMatic CCU2 devices before firmware 2.41.8 and CCU3 devices before firmware 3.43.15. The flaw allows an unauthenticated attacker to obtain a session ID through the user authentication dialogue, leading to automatic login as an administrator due to missing authorization checks. This vulnerability carries a CVSSv3 score of 9.8 (CRITICAL), indicating a severe risk with a network attack vector, low attack complexity, and high impact on confidentiality, integrity, and availability. Despite its critical severity, there is no evidence of active exploitation, publicly available exploit code (Metasploit, Nuclei, ExploitDB), or significant community discussion or media coverage surrounding this CVE.