CVE-2019-14475

CVE-2019-14475 affects eQ-3 Homematic CCU2 and CCU3 devices running firmware versions 2.47.15 and 3.47.15 or prior. This vulnerability stems from a lack of authorization checks, allowing an attacker who has obtained a valid session ID (potentially via CVE-2019-9583) to bypass intended access controls. With a CVSS score of 7.5 (HIGH), this flaw permits unauthorized actions such as reading service messages, clearing system logs, creating new users, or modifying/deleting internal programs. While the EPSS score is low and there is no evidence of active exploitation, public exploit code, or significant community discussion, the potential for high impact remains.