# Nodes Joined With AND CVEs with a configuration node whose CPE matches are joined with AND. Source: https://docs.deepinfo.com/reference/vulnerability/search/examples/configurations-nodes-operator/ Last updated: 2026-09-26 --- `POST https://api.deepinfo.com/v1/discovery/vulnerability-search?page_size=25` CVEs with a configuration node whose CPE matches are joined with AND. Example 2 of 10 in **Filters › Configurations** · [Vulnerability Search Examples](/reference/vulnerability/search/examples/) · endpoint: [Search](/reference/vulnerability/search/) Tags: `field` `configurations.nodes.operator` · `operator` `eq` `configurations.nodes.operator` joins the CPE matches of a node (`OR` or `AND`). `eq` matches the exact value `AND`. In the response, look at `results[].configurations[].nodes[].operator`. ## Request | Parameter | In | Value | |---|---|---| | `page_size` | query | `25` | | `filters.must[0].name` | body | `configurations.nodes.operator` | | `filters.must[0].type` | body | `eq` | | `filters.must[0].value` | body | `AND` | ```bash curl -X POST 'https://api.deepinfo.com/v1/discovery/vulnerability-search?page_size=25' \ -H 'apikey: YOUR_API_KEY' \ -H 'Accept: application/json' \ -H 'Content-Type: application/json' \ -d '{ "filters": { "must": [ { "name": "configurations.nodes.operator", "type": "eq", "value": "AND" } ] } }' ``` ## Response ### 200 · OK > Shortened for this page: results: 3 of 23 shown; results[].configurations: first 10 items; results[].enrichment.cpe: first 10 items `Content-Type: application/json` · `ratelimit-limit: 1` · `ratelimit-remaining: 0` · `ratelimit-reset: 1` · `x-ratelimit-limit-second: 1` · `x-ratelimit-remaining-second: 0` · `deepinfo-request-id: 5f0c6a8e-1b2d-4c3e-9f4a-7b8c9d0e1f2a` ```json { "page": 1, "page_size": 25, "result_count": 23, "results": [ { "id": "CVE-2020-10257", "source_identifier": "user@mitre.org", "published": "2020-03-10T00:15:10Z", "last_modified": "2026-06-17T02:47:34Z", "status": "Modified", "evaluator_comment": null, "evaluator_solution": null, "evaluator_impact": null, "cisa_exploit_add": null, "cisa_action_due": null, "cisa_required_action": null, "cisa_vulnerability_name": null, "descriptions": [ { "lang": "en", "value": "The ThemeREX Addons plugin before 2020-03-09 for WordPress lacks access control on the /trx_addons/v2/get/sc_layout REST API endpoint, allowing for PHP functions to be executed by any users, because includes/plugin.rest-api.php calls trx_addons_rest_get_sc_layout with an unsafe sc parameter." }, { "lang": "es", "value": "El plugin ThemeREX Addons antes del 09-03-2020 para WordPress, presenta una falta de control de acceso en el endpoint de la API REST /trx_addons/v2/get/sc_layout, permitiendo que funciones PHP sean ejecutadas por cualquier usuario, porque el archivo includes/plugin.rest-api.php llama a la función trx_addons_rest_get_sc_layout con un parámetro sc no seguro." } ], "references": [ { "url": "https://www.wordfence.com/blog/2020/03/zero-day-vulnerability-in-themerex-addons-now-patched/", "source": "user@mitre.org", "tags": [ "Exploit", "Third Party Advisory" ] }, { "url": "https://www.wordfence.com/blog/2020/03/zero-day-vulnerability-in-themerex-addons-now-patched/", "source": "af854a3a-2127-422b-91ae-364da2661108", "tags": [ "Exploit", "Third Party Advisory" ] } ], "metrics": { "cvss_metric_v40": null, "cvss_metric_v31": [ { "source": "user@nist.gov", "type": "Primary", "cvss_data": { "version": "3.1", "vector_string": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "attack_vector": "NETWORK", "attack_complexity": "LOW", "privileges_required": "NONE", "user_interaction": "NONE", "scope": "UNCHANGED", "confidentiality_impact": "HIGH", "integrity_impact": "HIGH", "availability_impact": "HIGH", "base_score": 9.8, "base_severity": "CRITICAL", "exploit_code_maturity": null, "remediation_level": null, "report_confidence": null, "temporal_score": null, "temporal_severity": null, "confidentiality_requirement": null, "integrity_requirement": null, "availability_requirement": null, "modified_attack_vector": null, "modified_attack_complexity": null, "modified_privileges_required": null, "modified_user_interaction": null, "modified_scope": null, "modified_confidentiality_impact": null, "modified_integrity_impact": null, "modified_availability_impact": null, "environmental_score": null, "environmental_severity": null }, "exploitability_score": 3.9, "impact_score": 5.9 } ], "cvss_metric_v30": [ { "source": "user@mitre.org", "type": "Secondary", "cvss_data": { "version": "3.0", "vector_string": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "attack_vector": "NETWORK", "attack_complexity": "LOW", "privileges_required": "NONE", "user_interaction": "NONE", "scope": "UNCHANGED", "confidentiality_impact": "HIGH", "integrity_impact": "HIGH", "availability_impact": "HIGH", "base_score": 9.8, "base_severity": "CRITICAL", "exploit_code_maturity": null, "remediation_level": null, "report_confidence": null, "temporal_score": null, "temporal_severity": null, "confidentiality_requirement": null, "integrity_requirement": null, "availability_requirement": null, "modified_attack_vector": null, "modified_attack_complexity": null, "modified_privileges_required": null, "modified_user_interaction": null, "modified_scope": null, "modified_confidentiality_impact": null, "modified_integrity_impact": null, "modified_availability_impact": null, "environmental_score": null, "environmental_severity": null }, "exploitability_score": 3.9, "impact_score": 5.9 } ], "cvss_metric_v2": [ { "source": "user@nist.gov", "type": "Primary", "cvss_data": { "version": "2.0", "vector_string": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "access_vector": "NETWORK", "access_complexity": "LOW", "authentication": "NONE", "confidentiality_impact": "PARTIAL", "integrity_impact": "PARTIAL", "availability_impact": "PARTIAL", "base_score": 7.5, "exploitability": null, "remediation_level": null, "report_confidence": null, "temporal_score": null, "collateral_damage_potential": null, "target_distribution": null, "confidentiality_requirement": null, "integrity_requirement": null, "availability_requirement": null, "environmental_score": null }, "base_severity": "HIGH", "exploitability_score": 10.0, "impact_score": 6.4, "ac_insuf_info": false, "obtain_all_privilege": false, "obtain_user_privilege": false, "obtain_other_privilege": false, "user_interaction_required": false } ] }, "weaknesses": [ { "source": "user@nist.gov", "type": "Primary", "description": [ { "lang": "en", "value": "CWE-94" }, { "lang": "en", "value": "CWE-862" } ] } ], "configurations": [ { "operator": null, "negate": null, "nodes": [ { "operator": "AND", "negate": false, "cpe_match": [ { "vulnerable": true, "criteria": "cpe:2.3:a:themerex:addons:1.70.3:*:*:*:*:wordpress:*:*", "match_criteria_id": "415D8A2D-344D-4A75-A834-C6C4C68ACF47", "version_start_including": null, "version_start_excluding": null, "version_end_including": null, "version_end_excluding": null }, { "vulnerable": true, "criteria": "cpe:2.3:a:themerex:ozeum-museum:*:*:*:*:*:wordpress:*:*", "match_criteria_id": "76F58E84-8810-4221-BC84-5B152A53529D", "version_start_including": null, "version_start_excluding": null, "version_end_including": null, "version_end_excluding": "1.0.2" } ] } ] }, { "operator": null, "negate": null, "nodes": [ { "operator": "AND", "negate": false, "cpe_match": [ { "vulnerable": true, "criteria": "cpe:2.3:a:themerex:addons:1.70.3:*:*:*:*:wordpress:*:*", "match_criteria_id": "415D8A2D-344D-4A75-A834-C6C4C68ACF47", "version_start_including": null, "version_start_excluding": null, "version_end_including": null, "version_end_excluding": null }, { "vulnerable": true, "criteria": "cpe:2.3:a:themerex:chit_club-board_games:*:*:*:*:*:wordpress:*:*", "match_criteria_id": "B9A00971-2A40-476B-BB49-4D0FA36DE6CA", "version_start_including": null, "version_start_excluding": null, "version_end_including": null, "version_end_excluding": "1.0.1" } ] } ] }, { "operator": null, "negate": null, "nodes": [ { "operator": "AND", "negate": false, "cpe_match": [ { "vulnerable": true, "criteria": "cpe:2.3:a:themerex:addons:1.6.67:*:*:*:*:wordpress:*:*", "match_criteria_id": "0F2EF7DE-F1C2-4245-A5EF-7BBD702B76F0", "version_start_including": null, "version_start_excluding": null, "version_end_including": null, "version_end_excluding": null }, { "vulnerable": true, "criteria": "cpe:2.3:a:themerex:yottis-simple_portfolio:*:*:*:*:*:wordpress:*:*", "match_criteria_id": "7AF13B64-D55F-4D02-9D77-95CF994AE995", "version_start_including": null, "version_start_excluding": null, "version_end_including": null, "version_end_excluding": "1.0.1" } ] } ] }, { "operator": null, "negate": null, "nodes": [ { "operator": "AND", "negate": false, "cpe_match": [ { "vulnerable": true, "criteria": "cpe:2.3:a:themerex:addons:1.6.66:*:*:*:*:wordpress:*:*", "match_criteria_id": "3661314B-3DD1-495E-9EDC-3A01725A06E7", "version_start_including": null, "version_start_excluding": null, "version_end_including": null, "version_end_excluding": null }, { "vulnerable": true, "criteria": "cpe:2.3:a:themerex:helion-agency_&portfolio:*:*:*:*:*:wordpress:*:*", "match_criteria_id": "EE4A6B17-FB56-4BCB-A725-B8BD0A1031A2", "version_start_including": null, "version_start_excluding": null, "version_end_including": null, "version_end_excluding": "1.0.3" } ] } ] }, { "operator": null, "negate": null, "nodes": [ { "operator": "AND", "negate": false, "cpe_match": [ { "vulnerable": true, "criteria": "cpe:2.3:a:themerex:addons:1.6.66:*:*:*:*:wordpress:*:*", "match_criteria_id": "3661314B-3DD1-495E-9EDC-3A01725A06E7", "version_start_including": null, "version_start_excluding": null, "version_end_including": null, "version_end_excluding": null }, { "vulnerable": true, "criteria": "cpe:2.3:a:themerex:amuli:*:*:*:*:*:wordpress:*:*", "match_criteria_id": "CC9A01E6-7BFB-4FC7-B3AA-CC812DBEC186", "version_start_including": null, "version_start_excluding": null, "version_end_including": null, "version_end_excluding": "1.0.2" } ] } ] }, { "operator": null, "negate": null, "nodes": [ { "operator": "AND", "negate": false, "cpe_match": [ { "vulnerable": true, "criteria": "cpe:2.3:a:themerex:addons:1.6.65:*:*:*:*:wordpress:*:*", "match_criteria_id": "F96C11A5-9A64-4F0D-A9B8-308C4A06B997", "version_start_including": null, "version_start_excluding": null, "version_end_including": null, "version_end_excluding": null }, { "vulnerable": true, "criteria": "cpe:2.3:a:themerex:nelson-barbershop_+_tattoo_salon:*:*:*:*:*:wordpress:*:*", "match_criteria_id": "3A335E4B-84C4-4FC7-BD47-6D939ED5782C", "version_start_including": null, "version_start_excluding": null, "version_end_including": null, "version_end_excluding": "1.0.1.2001" } ] } ] }, { "operator": null, "negate": null, "nodes": [ { "operator": "AND", "negate": false, "cpe_match": [ { "vulnerable": true, "criteria": "cpe:2.3:a:themerex:addons:1.6.65:*:*:*:*:wordpress:*:*", "match_criteria_id": "F96C11A5-9A64-4F0D-A9B8-308C4A06B997", "version_start_including": null, "version_start_excluding": null, "version_end_including": null, "version_end_excluding": null }, { "vulnerable": true, "criteria": "cpe:2.3:a:themerex:hallelujah-church:*:*:*:*:*:wordpress:*:*", "match_criteria_id": "7700EC98-EB55-420A-B194-B394C5479827", "version_start_including": null, "version_start_excluding": null, "version_end_including": null, "version_end_excluding": "1.0.1" } ] } ] }, { "operator": null, "negate": null, "nodes": [ { "operator": "AND", "negate": false, "cpe_match": [ { "vulnerable": true, "criteria": "cpe:2.3:a:themerex:addons:1.6.65:*:*:*:*:wordpress:*:*", "match_criteria_id": "F96C11A5-9A64-4F0D-A9B8-308C4A06B997", "version_start_including": null, "version_start_excluding": null, "version_end_including": null, "version_end_excluding": null }, { "vulnerable": true, "criteria": "cpe:2.3:a:themerex:right_way:*:*:*:*:*:wordpress:*:*", "match_criteria_id": "150D52DF-FE9F-46CC-AA67-D0F9F9D27593", "version_start_including": null, "version_start_excluding": null, "version_end_including": null, "version_end_excluding": "4.0.1" } ] } ] }, { "operator": null, "negate": null, "nodes": [ { "operator": "AND", "negate": false, "cpe_match": [ { "vulnerable": true, "criteria": "cpe:2.3:a:themerex:addons:1.6.65:*:*:*:*:wordpress:*:*", "match_criteria_id": "F96C11A5-9A64-4F0D-A9B8-308C4A06B997", "version_start_including": null, "version_start_excluding": null, "version_end_including": null, "version_end_excluding": null }, { "vulnerable": true, "criteria": "cpe:2.3:a:themerex:prider-pride_fest:*:*:*:*:*:wordpress:*:*", "match_criteria_id": "79D33A86-DB23-4903-B241-8A42D290C9DF", "version_start_including": null, "version_start_excluding": null, "version_end_including": null, "version_end_excluding": "1.0.2" } ] } ] }, { "operator": null, "negate": null, "nodes": [ { "operator": "AND", "negate": false, "cpe_match": [ { "vulnerable": true, "criteria": "cpe:2.3:a:themerex:addons:1.6.62.3:*:*:*:*:wordpress:*:*", "match_criteria_id": "7ECD4BD2-C6E4-4B61-B4D1-ABB96C151153", "version_start_including": null, "version_start_excluding": null, "version_end_including": null, "version_end_excluding": null }, { "vulnerable": true, "criteria": "cpe:2.3:a:themerex:mystik-esoterics:*:*:*:*:*:wordpress:*:*", "match_criteria_id": "3AA23F39-84FE-43DE-80BF-9A0F5A13E630", "version_start_including": null, "version_start_excluding": null, "version_end_including": null, "version_end_excluding": "1.0.1" } ] } ] } ], "vendor_comments": null, "enrichment": { "cpe": [ { "criteria": "cpe:2.3:a:themerex:addons:1.70.3:*:*:*:*:wordpress:*:*", "vendor": "themerex", "product": "addons", "product_type": "a", "vulnerable": true, "version_start_including": null, "version_start_excluding": null, "version_end_including": null, "version_end_excluding": null, "affected_versions_first": "1.70.3", "affected_versions_last": "1.70.3" }, { "criteria": "cpe:2.3:a:themerex:ozeum-museum:*:*:*:*:*:wordpress:*:*", "vendor": "themerex", "product": "ozeum-museum", "product_type": "a", "vulnerable": true, "version_start_including": null, "version_start_excluding": null, "version_end_including": null, "version_end_excluding": "1.0.2", "affected_versions_first": null, "affected_versions_last": null }, { "criteria": "cpe:2.3:a:themerex:chit_club-board_games:*:*:*:*:*:wordpress:*:*", "vendor": "themerex", "product": "chit_club-board_games", "product_type": "a", "vulnerable": true, "version_start_including": null, "version_start_excluding": null, "version_end_including": null, "version_end_excluding": "1.0.1", "affected_versions_first": null, "affected_versions_last": null }, { "criteria": "cpe:2.3:a:themerex:addons:1.6.67:*:*:*:*:wordpress:*:*", "vendor": "themerex", "product": "addons", "product_type": "a", "vulnerable": true, "version_start_including": null, "version_start_excluding": null, "version_end_including": null, "version_end_excluding": null, "affected_versions_first": "1.6.67", "affected_versions_last": "1.6.67" }, { "criteria": "cpe:2.3:a:themerex:yottis-simple_portfolio:*:*:*:*:*:wordpress:*:*", "vendor": "themerex", "product": "yottis-simple_portfolio", "product_type": "a", "vulnerable": true, "version_start_including": null, "version_start_excluding": null, "version_end_including": null, "version_end_excluding": "1.0.1", "affected_versions_first": null, "affected_versions_last": null }, { "criteria": "cpe:2.3:a:themerex:addons:1.6.66:*:*:*:*:wordpress:*:*", "vendor": "themerex", "product": "addons", "product_type": "a", "vulnerable": true, "version_start_including": null, "version_start_excluding": null, "version_end_including": null, "version_end_excluding": null, "affected_versions_first": "1.6.66", "affected_versions_last": "1.6.66" }, { "criteria": "cpe:2.3:a:themerex:helion-agency_&portfolio:*:*:*:*:*:wordpress:*:*", "vendor": "themerex", "product": "helion-agency_&portfolio", "product_type": "a", "vulnerable": true, "version_start_including": null, "version_start_excluding": null, "version_end_including": null, "version_end_excluding": "1.0.3", "affected_versions_first": null, "affected_versions_last": null }, { "criteria": "cpe:2.3:a:themerex:amuli:*:*:*:*:*:wordpress:*:*", "vendor": "themerex", "product": "amuli", "product_type": "a", "vulnerable": true, "version_start_including": null, "version_start_excluding": null, "version_end_including": null, "version_end_excluding": "1.0.2", "affected_versions_first": null, "affected_versions_last": null }, { "criteria": "cpe:2.3:a:themerex:addons:1.6.65:*:*:*:*:wordpress:*:*", "vendor": "themerex", "product": "addons", "product_type": "a", "vulnerable": true, "version_start_including": null, "version_start_excluding": null, "version_end_including": null, "version_end_excluding": null, "affected_versions_first": "1.6.65", "affected_versions_last": "1.6.65" }, { "criteria": "cpe:2.3:a:themerex:nelson-barbershop_+_tattoo_salon:*:*:*:*:*:wordpress:*:*", "vendor": "themerex", "product": "nelson-barbershop_+_tattoo_salon", "product_type": "a", "vulnerable": true, "version_start_including": null, "version_start_excluding": null, "version_end_including": null, "version_end_excluding": "1.0.1.2001", "affected_versions_first": null, "affected_versions_last": null } ], "cwe": [ { "id": 862, "owasptop10_2021": "A01 Broken Access Control", "name": "Missing Authorization", "description": "The product does not perform an authorization check when an actor attempts to access a resource or perform an action.", "capec_id": [ 665 ], "scope": [ "Access Control", "Availability", "Confidentiality", "Integrity" ], "impact": [ "Bypass Protection Mechanism", "DoS: Crash, Exit, or Restart", "DoS: Resource Consumption (CPU)", "DoS: Resource Consumption (Memory)", "DoS: Resource Consumption (Other)", "Gain Privileges or Assume Identity", "Modify Application Data", "Modify Files or Directories", "Read Application Data", "Read Files or Directories" ], "detection_method": [ "Architecture or Design Review", "Automated Dynamic Analysis", "Automated Static Analysis", "Automated Static Analysis - Source Code", "Dynamic Analysis with Automated Results Interpretation", "Dynamic Analysis with Manual Results Interpretation", "Manual Analysis", "Manual Static Analysis - Binary or Bytecode", "Manual Static Analysis - Source Code" ] }, { "id": 94, "owasptop10_2021": "A03 Injection", "name": "Improper Control of Generation of Code ('Code Injection')", "description": "The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.", "capec_id": [ 35, 77, 242 ], "scope": [ "Access Control", "Availability", "Confidentiality", "Integrity", "Non-Repudiation" ], "impact": [ "Bypass Protection Mechanism", "Execute Unauthorized Code or Commands", "Gain Privileges or Assume Identity", "Hide Activities" ], "detection_method": [ "Automated Static Analysis" ] } ], "epss_score": { "epss": 0.08877, "percentile": 0.94987, "date": "2026-09-23" }, "cisa_kev": null, "vdeep_metric": { "available_versions": [ "3.1", "3.0", "2.0" ], "source": "user@nist.gov", "type": "Primary", "cvss_data": { "version": "3.1", "vector_string": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "attack_vector": "NETWORK", "attack_complexity": "LOW", "attack_requirements": null, "privileges_required": "NONE", "user_interaction": "NONE", "vulnerable_system_confidentiality": "HIGH", "vulnerable_system_integrity": "HIGH", "vulnerable_system_availability": "HIGH", "subsequent_system_confidentiality": null, "subsequent_system_integrity": null, "subsequent_system_availability": null, "exploit_maturity": null, "confidentiality_requirements": null, "integrity_requirements": null, "availability_requirements": null, "modified_attack_vector": null, "modified_attack_complexity": null, "modified_attack_requirements": null, "modified_privileges_required": null, "modified_user_interaction": null, "modified_vulnerable_system_confidentiality": null, "modified_vulnerable_system_integrity": null, "modified_vulnerable_system_availability": null, "modified_subsequent_system_confidentiality": null, "modified_subsequent_system_integrity": null, "modified_subsequent_system_availability": null, "safety": null, "automatable": null, "recovery": null, "value_density": null, "vulnerability_response_effort": null, "provider_urgency": null, "base_score": 9.8, "base_severity": "CRITICAL" } } } }, { "id": "CVE-2019-18939", "source_identifier": "user@mitre.org", "published": "2019-11-14T19:15:13Z", "last_modified": "2026-06-17T02:25:36Z", "status": "Modified", "evaluator_comment": null, "evaluator_solution": null, "evaluator_impact": null, "cisa_exploit_add": null, "cisa_action_due": null, "cisa_required_action": null, "cisa_vulnerability_name": null, "descriptions": [ { "lang": "en", "value": "eQ-3 Homematic CCU2 2.47.20 and CCU3 3.47.18 with the HM-Print AddOn through 1.2a installed allow Remote Code Execution by unauthenticated attackers with access to the web interface via the exec.cgi and exec1.cgi scripts, which execute TCL script content from an HTTP POST request." }, { "lang": "es", "value": "eQ-3 Homematic CCU2 versión 2.47.20 y CCU3 versión 3.47.18 con el AddOn HM-Print instalado versiones hasta 1.2a, permite la Ejecución de Código Remota por parte de atacantes no autenticados con acceso a la interfaz web por medio de los scripts exec.cgi y exec1.cgi, que ejecutan un contenido de script TCL desde una petición POST de HTTP." } ], "references": [ { "url": "https://psytester.github.io/CVE-2019-18939/", "source": "user@mitre.org", "tags": [ "Exploit", "Third Party Advisory" ] }, { "url": "https://psytester.github.io/CVE-2019-18939/", "source": "af854a3a-2127-422b-91ae-364da2661108", "tags": [ "Exploit", "Third Party Advisory" ] } ], "metrics": { "cvss_metric_v40": null, "cvss_metric_v31": [ { "source": "user@nist.gov", "type": "Primary", "cvss_data": { "version": "3.1", "vector_string": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "attack_vector": "NETWORK", "attack_complexity": "LOW", "privileges_required": "NONE", "user_interaction": "NONE", "scope": "UNCHANGED", "confidentiality_impact": "HIGH", "integrity_impact": "HIGH", "availability_impact": "HIGH", "base_score": 9.8, "base_severity": "CRITICAL", "exploit_code_maturity": null, "remediation_level": null, "report_confidence": null, "temporal_score": null, "temporal_severity": null, "confidentiality_requirement": null, "integrity_requirement": null, "availability_requirement": null, "modified_attack_vector": null, "modified_attack_complexity": null, "modified_privileges_required": null, "modified_user_interaction": null, "modified_scope": null, "modified_confidentiality_impact": null, "modified_integrity_impact": null, "modified_availability_impact": null, "environmental_score": null, "environmental_severity": null }, "exploitability_score": 3.9, "impact_score": 5.9 } ], "cvss_metric_v30": null, "cvss_metric_v2": [ { "source": "user@nist.gov", "type": "Primary", "cvss_data": { "version": "2.0", "vector_string": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "access_vector": "NETWORK", "access_complexity": "LOW", "authentication": "NONE", "confidentiality_impact": "PARTIAL", "integrity_impact": "PARTIAL", "availability_impact": "PARTIAL", "base_score": 7.5, "exploitability": null, "remediation_level": null, "report_confidence": null, "temporal_score": null, "collateral_damage_potential": null, "target_distribution": null, "confidentiality_requirement": null, "integrity_requirement": null, "availability_requirement": null, "environmental_score": null }, "base_severity": "HIGH", "exploitability_score": 10.0, "impact_score": 6.4, "ac_insuf_info": false, "obtain_all_privilege": false, "obtain_user_privilege": false, "obtain_other_privilege": false, "user_interaction_required": false } ] }, "weaknesses": [ { "source": "user@nist.gov", "type": "Primary", "description": [ { "lang": "en", "value": "CWE-306" } ] } ], "configurations": [ { "operator": null, "negate": null, "nodes": [ { "operator": "AND", "negate": false, "cpe_match": [ { "vulnerable": true, "criteria": "cpe:2.3:a:hm-print_project:hm-print:1.2a:*:*:*:*:*:*:*", "match_criteria_id": "286DA904-5631-4AAF-86DE-97C23982D2C5", "version_start_including": null, "version_start_excluding": null, "version_end_including": null, "version_end_excluding": null }, { "vulnerable": false, "criteria": "cpe:2.3:h:eq-3:homematic_ccu2:-:*:*:*:*:*:*:*", "match_criteria_id": "9C2CF19C-7EDE-4E3C-A736-E6736FF03FDC", "version_start_including": null, "version_start_excluding": null, "version_end_including": null, "version_end_excluding": null }, { "vulnerable": true, "criteria": "cpe:2.3:o:eq-3:homematic_ccu2_firmware:2.47.20:*:*:*:*:*:*:*", "match_criteria_id": "38BE17DA-7C5E-427E-B824-151EB27CFF26", "version_start_including": null, "version_start_excluding": null, "version_end_including": null, "version_end_excluding": null } ] } ] }, { "operator": null, "negate": null, "nodes": [ { "operator": "AND", "negate": false, "cpe_match": [ { "vulnerable": true, "criteria": "cpe:2.3:a:hm-print_project:hm-print:1.2:*:*:*:*:*:*:*", "match_criteria_id": "F5D8290F-3541-4452-99CB-0766CDC59073", "version_start_including": null, "version_start_excluding": null, "version_end_including": null, "version_end_excluding": null }, { "vulnerable": false, "criteria": "cpe:2.3:h:eq-3:homematic_ccu3:-:*:*:*:*:*:*:*", "match_criteria_id": "33113AD0-F378-49B2-BCFC-C57B52FD3A04", "version_start_including": null, "version_start_excluding": null, "version_end_including": null, "version_end_excluding": null }, { "vulnerable": true, "criteria": "cpe:2.3:o:eq-3:homematic_ccu3_firmware:3.47.18:*:*:*:*:*:*:*", "match_criteria_id": "285F4E29-E299-4F83-9F7E-BB19933AD654", "version_start_including": null, "version_start_excluding": null, "version_end_including": null, "version_end_excluding": null } ] } ] }, { "operator": null, "negate": null, "nodes": [ { "operator": "AND", "negate": false, "cpe_match": [ { "vulnerable": true, "criteria": "cpe:2.3:a:hm-print_project:hm-print:1.2a:*:*:*:*:*:*:*", "match_criteria_id": "286DA904-5631-4AAF-86DE-97C23982D2C5", "version_start_including": null, "version_start_excluding": null, "version_end_including": null, "version_end_excluding": null }, { "vulnerable": false, "criteria": "cpe:2.3:h:eq-3:homematic_ccu3:-:*:*:*:*:*:*:*", "match_criteria_id": "33113AD0-F378-49B2-BCFC-C57B52FD3A04", "version_start_including": null, "version_start_excluding": null, "version_end_including": null, "version_end_excluding": null }, { "vulnerable": true, "criteria": "cpe:2.3:o:eq-3:homematic_ccu3_firmware:3.47.18:*:*:*:*:*:*:*", "match_criteria_id": "285F4E29-E299-4F83-9F7E-BB19933AD654", "version_start_including": null, "version_start_excluding": null, "version_end_including": null, "version_end_excluding": null } ] } ] }, { "operator": null, "negate": null, "nodes": [ { "operator": "AND", "negate": false, "cpe_match": [ { "vulnerable": true, "criteria": "cpe:2.3:a:hm-print_project:hm-print:1.2:*:*:*:*:*:*:*", "match_criteria_id": "F5D8290F-3541-4452-99CB-0766CDC59073", "version_start_including": null, "version_start_excluding": null, "version_end_including": null, "version_end_excluding": null }, { "vulnerable": false, "criteria": "cpe:2.3:h:eq-3:homematic_ccu2:-:*:*:*:*:*:*:*", "match_criteria_id": "9C2CF19C-7EDE-4E3C-A736-E6736FF03FDC", "version_start_including": null, "version_start_excluding": null, "version_end_including": null, "version_end_excluding": null }, { "vulnerable": true, "criteria": "cpe:2.3:o:eq-3:homematic_ccu2_firmware:2.47.20:*:*:*:*:*:*:*", "match_criteria_id": "38BE17DA-7C5E-427E-B824-151EB27CFF26", "version_start_including": null, "version_start_excluding": null, "version_end_including": null, "version_end_excluding": null } ] } ] } ], "vendor_comments": null, "enrichment": { "cpe": [ { "criteria": "cpe:2.3:a:hm-print_project:hm-print:1.2a:*:*:*:*:*:*:*", "vendor": "hm-print_project", "product": "hm-print", "product_type": "a", "vulnerable": true, "version_start_including": null, "version_start_excluding": null, "version_end_including": null, "version_end_excluding": null, "affected_versions_first": "1.2a", "affected_versions_last": "1.2a" }, { "criteria": "cpe:2.3:h:eq-3:homematic_ccu2:-:*:*:*:*:*:*:*", "vendor": "eq-3", "product": "homematic_ccu2", "product_type": "h", "vulnerable": false, "version_start_including": null, "version_start_excluding": null, "version_end_including": null, "version_end_excluding": null, "affected_versions_first": null, "affected_versions_last": null }, { "criteria": "cpe:2.3:o:eq-3:homematic_ccu2_firmware:2.47.20:*:*:*:*:*:*:*", "vendor": "eq-3", "product": "homematic_ccu2_firmware", "product_type": "o", "vulnerable": true, "version_start_including": null, "version_start_excluding": null, "version_end_including": null, "version_end_excluding": null, "affected_versions_first": "2.47.20", "affected_versions_last": "2.47.20" }, { "criteria": "cpe:2.3:a:hm-print_project:hm-print:1.2:*:*:*:*:*:*:*", "vendor": "hm-print_project", "product": "hm-print", "product_type": "a", "vulnerable": true, "version_start_including": null, "version_start_excluding": null, "version_end_including": null, "version_end_excluding": null, "affected_versions_first": "1.2", "affected_versions_last": "1.2" }, { "criteria": "cpe:2.3:h:eq-3:homematic_ccu3:-:*:*:*:*:*:*:*", "vendor": "eq-3", "product": "homematic_ccu3", "product_type": "h", "vulnerable": false, "version_start_including": null, "version_start_excluding": null, "version_end_including": null, "version_end_excluding": null, "affected_versions_first": null, "affected_versions_last": null }, { "criteria": "cpe:2.3:o:eq-3:homematic_ccu3_firmware:3.47.18:*:*:*:*:*:*:*", "vendor": "eq-3", "product": "homematic_ccu3_firmware", "product_type": "o", "vulnerable": true, "version_start_including": null, "version_start_excluding": null, "version_end_including": null, "version_end_excluding": null, "affected_versions_first": "3.47.18", "affected_versions_last": "3.47.18" } ], "cwe": [ { "id": 306, "owasptop10_2021": "A07 Identification and Authentication Failures", "name": "Missing Authentication for Critical Function", "description": "The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.", "capec_id": [ 12, 36, 62, 166, 216 ], "scope": [ "Access Control", "Other" ], "impact": [ "Gain Privileges or Assume Identity", "Varies by Context" ], "detection_method": [ "Architecture or Design Review", "Automated Static Analysis", "Automated Static Analysis - Source Code", "Dynamic Analysis with Automated Results Interpretation", "Dynamic Analysis with Manual Results Interpretation", "Manual Analysis", "Manual Static Analysis - Binary or Bytecode", "Manual Static Analysis - Source Code" ] } ], "epss_score": { "epss": 0.40785, "percentile": 0.98594, "date": "2026-09-23" }, "cisa_kev": null, "vdeep_metric": { "available_versions": [ "3.1", "2.0" ], "source": "user@nist.gov", "type": "Primary", "cvss_data": { "version": "3.1", "vector_string": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "attack_vector": "NETWORK", "attack_complexity": "LOW", "attack_requirements": null, "privileges_required": "NONE", "user_interaction": "NONE", "vulnerable_system_confidentiality": "HIGH", "vulnerable_system_integrity": "HIGH", "vulnerable_system_availability": "HIGH", "subsequent_system_confidentiality": null, "subsequent_system_integrity": null, "subsequent_system_availability": null, "exploit_maturity": null, "confidentiality_requirements": null, "integrity_requirements": null, "availability_requirements": null, "modified_attack_vector": null, "modified_attack_complexity": null, "modified_attack_requirements": null, "modified_privileges_required": null, "modified_user_interaction": null, "modified_vulnerable_system_confidentiality": null, "modified_vulnerable_system_integrity": null, "modified_vulnerable_system_availability": null, "modified_subsequent_system_confidentiality": null, "modified_subsequent_system_integrity": null, "modified_subsequent_system_availability": null, "safety": null, "automatable": null, "recovery": null, "value_density": null, "vulnerability_response_effort": null, "provider_urgency": null, "base_score": 9.8, "base_severity": "CRITICAL" } } } }, { "id": "CVE-2019-18937", "source_identifier": "user@mitre.org", "published": "2019-11-14T19:15:13Z", "last_modified": "2026-06-17T02:25:36Z", "status": "Modified", "evaluator_comment": null, "evaluator_solution": null, "evaluator_impact": null, "cisa_exploit_add": null, "cisa_action_due": null, "cisa_required_action": null, "cisa_vulnerability_name": null, "descriptions": [ { "lang": "en", "value": "eQ-3 Homematic CCU2 2.47.20 and CCU3 3.47.18 with the Script Parser AddOn through 1.8 installed allow Remote Code Execution by unauthenticated attackers with access to the web interface via the exec.cgi script, which executes TCL script content from an HTTP POST request." }, { "lang": "es", "value": "eQ-3 Homematic CCU2 versión 2.47.20 y CCU3 versión 3.47.18 con el AddOn Script Parser instalado versiones hasta 1.8, permite una Ejecución de Código Remota por parte de atacantes no autenticados con acceso a la interfaz web por medio de l script exec.cgi, que ejecuta un contenido de script TCL desde una petición POST de HTTP." } ], "references": [ { "url": "https://psytester.github.io/CVE-2019-18937/", "source": "user@mitre.org", "tags": [ "Exploit", "Third Party Advisory" ] }, { "url": "https://psytester.github.io/CVE-2019-18937/", "source": "af854a3a-2127-422b-91ae-364da2661108", "tags": [ "Exploit", "Third Party Advisory" ] } ], "metrics": { "cvss_metric_v40": null, "cvss_metric_v31": [ { "source": "user@nist.gov", "type": "Primary", "cvss_data": { "version": "3.1", "vector_string": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "attack_vector": "NETWORK", "attack_complexity": "LOW", "privileges_required": "NONE", "user_interaction": "NONE", "scope": "UNCHANGED", "confidentiality_impact": "HIGH", "integrity_impact": "HIGH", "availability_impact": "HIGH", "base_score": 9.8, "base_severity": "CRITICAL", "exploit_code_maturity": null, "remediation_level": null, "report_confidence": null, "temporal_score": null, "temporal_severity": null, "confidentiality_requirement": null, "integrity_requirement": null, "availability_requirement": null, "modified_attack_vector": null, "modified_attack_complexity": null, "modified_privileges_required": null, "modified_user_interaction": null, "modified_scope": null, "modified_confidentiality_impact": null, "modified_integrity_impact": null, "modified_availability_impact": null, "environmental_score": null, "environmental_severity": null }, "exploitability_score": 3.9, "impact_score": 5.9 } ], "cvss_metric_v30": null, "cvss_metric_v2": [ { "source": "user@nist.gov", "type": "Primary", "cvss_data": { "version": "2.0", "vector_string": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "access_vector": "NETWORK", "access_complexity": "LOW", "authentication": "NONE", "confidentiality_impact": "PARTIAL", "integrity_impact": "PARTIAL", "availability_impact": "PARTIAL", "base_score": 7.5, "exploitability": null, "remediation_level": null, "report_confidence": null, "temporal_score": null, "collateral_damage_potential": null, "target_distribution": null, "confidentiality_requirement": null, "integrity_requirement": null, "availability_requirement": null, "environmental_score": null }, "base_severity": "HIGH", "exploitability_score": 10.0, "impact_score": 6.4, "ac_insuf_info": false, "obtain_all_privilege": false, "obtain_user_privilege": false, "obtain_other_privilege": false, "user_interaction_required": false } ] }, "weaknesses": [ { "source": "user@nist.gov", "type": "Primary", "description": [ { "lang": "en", "value": "CWE-306" } ] } ], "configurations": [ { "operator": null, "negate": null, "nodes": [ { "operator": "AND", "negate": false, "cpe_match": [ { "vulnerable": true, "criteria": "cpe:2.3:a:scriptparser_project:scriptparser:1.8:*:*:*:*:*:*:*", "match_criteria_id": "AF7BA00E-B37D-4B57-8A8E-B97535AE7824", "version_start_including": null, "version_start_excluding": null, "version_end_including": null, "version_end_excluding": null }, { "vulnerable": false, "criteria": "cpe:2.3:h:eq-3:homematic_ccu2:-:*:*:*:*:*:*:*", "match_criteria_id": "9C2CF19C-7EDE-4E3C-A736-E6736FF03FDC", "version_start_including": null, "version_start_excluding": null, "version_end_including": null, "version_end_excluding": null }, { "vulnerable": true, "criteria": "cpe:2.3:o:eq-3:homematic_ccu2_firmware:2.47.20:*:*:*:*:*:*:*", "match_criteria_id": "38BE17DA-7C5E-427E-B824-151EB27CFF26", "version_start_including": null, "version_start_excluding": null, "version_end_including": null, "version_end_excluding": null } ] } ] }, { "operator": null, "negate": null, "nodes": [ { "operator": "AND", "negate": false, "cpe_match": [ { "vulnerable": true, "criteria": "cpe:2.3:a:scriptparser_project:scriptparser:1.8:*:*:*:*:*:*:*", "match_criteria_id": "AF7BA00E-B37D-4B57-8A8E-B97535AE7824", "version_start_including": null, "version_start_excluding": null, "version_end_including": null, "version_end_excluding": null }, { "vulnerable": false, "criteria": "cpe:2.3:h:eq-3:homematic_ccu3:-:*:*:*:*:*:*:*", "match_criteria_id": "33113AD0-F378-49B2-BCFC-C57B52FD3A04", "version_start_including": null, "version_start_excluding": null, "version_end_including": null, "version_end_excluding": null }, { "vulnerable": true, "criteria": "cpe:2.3:o:eq-3:homematic_ccu3_firmware:3.47.18:*:*:*:*:*:*:*", "match_criteria_id": "285F4E29-E299-4F83-9F7E-BB19933AD654", "version_start_including": null, "version_start_excluding": null, "version_end_including": null, "version_end_excluding": null } ] } ] }, { "operator": null, "negate": null, "nodes": [ { "operator": "AND", "negate": false, "cpe_match": [ { "vulnerable": true, "criteria": "cpe:2.3:a:scriptparser_project:scriptparser:1.7:*:*:*:*:*:*:*", "match_criteria_id": "73E20DD3-4661-43C3-9393-B73FEB2FCD86", "version_start_including": null, "version_start_excluding": null, "version_end_including": null, "version_end_excluding": null }, { "vulnerable": false, "criteria": "cpe:2.3:h:eq-3:homematic_ccu3:-:*:*:*:*:*:*:*", "match_criteria_id": "33113AD0-F378-49B2-BCFC-C57B52FD3A04", "version_start_including": null, "version_start_excluding": null, "version_end_including": null, "version_end_excluding": null }, { "vulnerable": true, "criteria": "cpe:2.3:o:eq-3:homematic_ccu3_firmware:3.47.18:*:*:*:*:*:*:*", "match_criteria_id": "285F4E29-E299-4F83-9F7E-BB19933AD654", "version_start_including": null, "version_start_excluding": null, "version_end_including": null, "version_end_excluding": null } ] } ] }, { "operator": null, "negate": null, "nodes": [ { "operator": "AND", "negate": false, "cpe_match": [ { "vulnerable": true, "criteria": "cpe:2.3:a:scriptparser_project:scriptparser:1.7:*:*:*:*:*:*:*", "match_criteria_id": "73E20DD3-4661-43C3-9393-B73FEB2FCD86", "version_start_including": null, "version_start_excluding": null, "version_end_including": null, "version_end_excluding": null }, { "vulnerable": false, "criteria": "cpe:2.3:h:eq-3:homematic_ccu2:-:*:*:*:*:*:*:*", "match_criteria_id": "9C2CF19C-7EDE-4E3C-A736-E6736FF03FDC", "version_start_including": null, "version_start_excluding": null, "version_end_including": null, "version_end_excluding": null }, { "vulnerable": true, "criteria": "cpe:2.3:o:eq-3:homematic_ccu2_firmware:2.47.20:*:*:*:*:*:*:*", "match_criteria_id": "38BE17DA-7C5E-427E-B824-151EB27CFF26", "version_start_including": null, "version_start_excluding": null, "version_end_including": null, "version_end_excluding": null } ] } ] }, { "operator": null, "negate": null, "nodes": [ { "operator": "AND", "negate": false, "cpe_match": [ { "vulnerable": true, "criteria": "cpe:2.3:a:scriptparser_project:scriptparser:1.6:*:*:*:*:*:*:*", "match_criteria_id": "AA60BB4B-71D9-453A-BDA6-3B2A5F18AD42", "version_start_including": null, "version_start_excluding": null, "version_end_including": null, "version_end_excluding": null }, { "vulnerable": false, "criteria": "cpe:2.3:h:eq-3:homematic_ccu2:-:*:*:*:*:*:*:*", "match_criteria_id": "9C2CF19C-7EDE-4E3C-A736-E6736FF03FDC", "version_start_including": null, "version_start_excluding": null, "version_end_including": null, "version_end_excluding": null }, { "vulnerable": true, "criteria": "cpe:2.3:o:eq-3:homematic_ccu2_firmware:2.47.20:*:*:*:*:*:*:*", "match_criteria_id": "38BE17DA-7C5E-427E-B824-151EB27CFF26", "version_start_including": null, "version_start_excluding": null, "version_end_including": null, "version_end_excluding": null } ] } ] }, { "operator": null, "negate": null, "nodes": [ { "operator": "AND", "negate": false, "cpe_match": [ { "vulnerable": true, "criteria": "cpe:2.3:a:scriptparser_project:scriptparser:1.5:*:*:*:*:*:*:*", "match_criteria_id": "D88DEE93-7D32-4ED1-AA27-9A2FBB2F9BE9", "version_start_including": null, "version_start_excluding": null, "version_end_including": null, "version_end_excluding": null }, { "vulnerable": false, "criteria": "cpe:2.3:h:eq-3:homematic_ccu2:-:*:*:*:*:*:*:*", "match_criteria_id": "9C2CF19C-7EDE-4E3C-A736-E6736FF03FDC", "version_start_including": null, "version_start_excluding": null, "version_end_including": null, "version_end_excluding": null }, { "vulnerable": true, "criteria": "cpe:2.3:o:eq-3:homematic_ccu2_firmware:2.47.20:*:*:*:*:*:*:*", "match_criteria_id": "38BE17DA-7C5E-427E-B824-151EB27CFF26", "version_start_including": null, "version_start_excluding": null, "version_end_including": null, "version_end_excluding": null } ] } ] }, { "operator": null, "negate": null, "nodes": [ { "operator": "AND", "negate": false, "cpe_match": [ { "vulnerable": true, "criteria": "cpe:2.3:a:scriptparser_project:scriptparser:1.4:*:*:*:*:*:*:*", "match_criteria_id": "7326D55B-8DF1-42B2-96DD-263CCD86E6D1", "version_start_including": null, "version_start_excluding": null, "version_end_including": null, "version_end_excluding": null }, { "vulnerable": false, "criteria": "cpe:2.3:h:eq-3:homematic_ccu2:-:*:*:*:*:*:*:*", "match_criteria_id": "9C2CF19C-7EDE-4E3C-A736-E6736FF03FDC", "version_start_including": null, "version_start_excluding": null, "version_end_including": null, "version_end_excluding": null }, { "vulnerable": true, "criteria": "cpe:2.3:o:eq-3:homematic_ccu2_firmware:2.47.20:*:*:*:*:*:*:*", "match_criteria_id": "38BE17DA-7C5E-427E-B824-151EB27CFF26", "version_start_including": null, "version_start_excluding": null, "version_end_including": null, "version_end_excluding": null } ] } ] }, { "operator": null, "negate": null, "nodes": [ { "operator": "AND", "negate": false, "cpe_match": [ { "vulnerable": true, "criteria": "cpe:2.3:a:scriptparser_project:scriptparser:1.3:*:*:*:*:*:*:*", "match_criteria_id": "BEBE241F-E464-4678-8B56-7F212A072A7D", "version_start_including": null, "version_start_excluding": null, "version_end_including": null, "version_end_excluding": null }, { "vulnerable": false, "criteria": "cpe:2.3:h:eq-3:homematic_ccu2:-:*:*:*:*:*:*:*", "match_criteria_id": "9C2CF19C-7EDE-4E3C-A736-E6736FF03FDC", "version_start_including": null, "version_start_excluding": null, "version_end_including": null, "version_end_excluding": null }, { "vulnerable": true, "criteria": "cpe:2.3:o:eq-3:homematic_ccu2_firmware:2.47.20:*:*:*:*:*:*:*", "match_criteria_id": "38BE17DA-7C5E-427E-B824-151EB27CFF26", "version_start_including": null, "version_start_excluding": null, "version_end_including": null, "version_end_excluding": null } ] } ] }, { "operator": null, "negate": null, "nodes": [ { "operator": "AND", "negate": false, "cpe_match": [ { "vulnerable": true, "criteria": "cpe:2.3:a:scriptparser_project:scriptparser:1.3:beta1:*:*:*:*:*:*", "match_criteria_id": "0EC54A24-1F1B-47FB-A4F7-AA30BFD98CD3", "version_start_including": null, "version_start_excluding": null, "version_end_including": null, "version_end_excluding": null }, { "vulnerable": false, "criteria": "cpe:2.3:h:eq-3:homematic_ccu2:-:*:*:*:*:*:*:*", "match_criteria_id": "9C2CF19C-7EDE-4E3C-A736-E6736FF03FDC", "version_start_including": null, "version_start_excluding": null, "version_end_including": null, "version_end_excluding": null }, { "vulnerable": true, "criteria": "cpe:2.3:o:eq-3:homematic_ccu2_firmware:2.47.20:*:*:*:*:*:*:*", "match_criteria_id": "38BE17DA-7C5E-427E-B824-151EB27CFF26", "version_start_including": null, "version_start_excluding": null, "version_end_including": null, "version_end_excluding": null } ] } ] }, { "operator": null, "negate": null, "nodes": [ { "operator": "AND", "negate": false, "cpe_match": [ { "vulnerable": true, "criteria": "cpe:2.3:a:scriptparser_project:scriptparser:1.2:*:*:*:*:*:*:*", "match_criteria_id": "3EB7F49C-306B-4731-B4A0-4630D1FC2388", "version_start_including": null, "version_start_excluding": null, "version_end_including": null, "version_end_excluding": null }, { "vulnerable": false, "criteria": "cpe:2.3:h:eq-3:homematic_ccu2:-:*:*:*:*:*:*:*", "match_criteria_id": "9C2CF19C-7EDE-4E3C-A736-E6736FF03FDC", "version_start_including": null, "version_start_excluding": null, "version_end_including": null, "version_end_excluding": null }, { "vulnerable": true, "criteria": "cpe:2.3:o:eq-3:homematic_ccu2_firmware:2.47.20:*:*:*:*:*:*:*", "match_criteria_id": "38BE17DA-7C5E-427E-B824-151EB27CFF26", "version_start_including": null, "version_start_excluding": null, "version_end_including": null, "version_end_excluding": null } ] } ] } ], "vendor_comments": null, "enrichment": { "cpe": [ { "criteria": "cpe:2.3:a:scriptparser_project:scriptparser:1.8:*:*:*:*:*:*:*", "vendor": "scriptparser_project", "product": "scriptparser", "product_type": "a", "vulnerable": true, "version_start_including": null, "version_start_excluding": null, "version_end_including": null, "version_end_excluding": null, "affected_versions_first": "1.8", "affected_versions_last": "1.8" }, { "criteria": "cpe:2.3:h:eq-3:homematic_ccu2:-:*:*:*:*:*:*:*", "vendor": "eq-3", "product": "homematic_ccu2", "product_type": "h", "vulnerable": false, "version_start_including": null, "version_start_excluding": null, "version_end_including": null, "version_end_excluding": null, "affected_versions_first": null, "affected_versions_last": null }, { "criteria": "cpe:2.3:o:eq-3:homematic_ccu2_firmware:2.47.20:*:*:*:*:*:*:*", "vendor": "eq-3", "product": "homematic_ccu2_firmware", "product_type": "o", "vulnerable": true, "version_start_including": null, "version_start_excluding": null, "version_end_including": null, "version_end_excluding": null, "affected_versions_first": "2.47.20", "affected_versions_last": "2.47.20" }, { "criteria": "cpe:2.3:h:eq-3:homematic_ccu3:-:*:*:*:*:*:*:*", "vendor": "eq-3", "product": "homematic_ccu3", "product_type": "h", "vulnerable": false, "version_start_including": null, "version_start_excluding": null, "version_end_including": null, "version_end_excluding": null, "affected_versions_first": null, "affected_versions_last": null }, { "criteria": "cpe:2.3:o:eq-3:homematic_ccu3_firmware:3.47.18:*:*:*:*:*:*:*", "vendor": "eq-3", "product": "homematic_ccu3_firmware", "product_type": "o", "vulnerable": true, "version_start_including": null, "version_start_excluding": null, "version_end_including": null, "version_end_excluding": null, "affected_versions_first": "3.47.18", "affected_versions_last": "3.47.18" }, { "criteria": "cpe:2.3:a:scriptparser_project:scriptparser:1.7:*:*:*:*:*:*:*", "vendor": "scriptparser_project", "product": "scriptparser", "product_type": "a", "vulnerable": true, "version_start_including": null, "version_start_excluding": null, "version_end_including": null, "version_end_excluding": null, "affected_versions_first": "1.7", "affected_versions_last": "1.7" }, { "criteria": "cpe:2.3:a:scriptparser_project:scriptparser:1.6:*:*:*:*:*:*:*", "vendor": "scriptparser_project", "product": "scriptparser", "product_type": "a", "vulnerable": true, "version_start_including": null, "version_start_excluding": null, "version_end_including": null, "version_end_excluding": null, "affected_versions_first": "1.6", "affected_versions_last": "1.6" }, { "criteria": "cpe:2.3:a:scriptparser_project:scriptparser:1.5:*:*:*:*:*:*:*", "vendor": "scriptparser_project", "product": "scriptparser", "product_type": "a", "vulnerable": true, "version_start_including": null, "version_start_excluding": null, "version_end_including": null, "version_end_excluding": null, "affected_versions_first": "1.5", "affected_versions_last": "1.5" }, { "criteria": "cpe:2.3:a:scriptparser_project:scriptparser:1.4:*:*:*:*:*:*:*", "vendor": "scriptparser_project", "product": "scriptparser", "product_type": "a", "vulnerable": true, "version_start_including": null, "version_start_excluding": null, "version_end_including": null, "version_end_excluding": null, "affected_versions_first": "1.4", "affected_versions_last": "1.4" }, { "criteria": "cpe:2.3:a:scriptparser_project:scriptparser:1.3:*:*:*:*:*:*:*", "vendor": "scriptparser_project", "product": "scriptparser", "product_type": "a", "vulnerable": true, "version_start_including": null, "version_start_excluding": null, "version_end_including": null, "version_end_excluding": null, "affected_versions_first": "1.3", "affected_versions_last": "1.3" } ], "cwe": [ { "id": 306, "owasptop10_2021": "A07 Identification and Authentication Failures", "name": "Missing Authentication for Critical Function", "description": "The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.", "capec_id": [ 12, 36, 62, 166, 216 ], "scope": [ "Access Control", "Other" ], "impact": [ "Gain Privileges or Assume Identity", "Varies by Context" ], "detection_method": [ "Architecture or Design Review", "Automated Static Analysis", "Automated Static Analysis - Source Code", "Dynamic Analysis with Automated Results Interpretation", "Dynamic Analysis with Manual Results Interpretation", "Manual Analysis", "Manual Static Analysis - Binary or Bytecode", "Manual Static Analysis - Source Code" ] } ], "epss_score": { "epss": 0.3384, "percentile": 0.98323, "date": "2026-09-23" }, "cisa_kev": null, "vdeep_metric": { "available_versions": [ "3.1", "2.0" ], "source": "user@nist.gov", "type": "Primary", "cvss_data": { "version": "3.1", "vector_string": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "attack_vector": "NETWORK", "attack_complexity": "LOW", "attack_requirements": null, "privileges_required": "NONE", "user_interaction": "NONE", "vulnerable_system_confidentiality": "HIGH", "vulnerable_system_integrity": "HIGH", "vulnerable_system_availability": "HIGH", "subsequent_system_confidentiality": null, "subsequent_system_integrity": null, "subsequent_system_availability": null, "exploit_maturity": null, "confidentiality_requirements": null, "integrity_requirements": null, "availability_requirements": null, "modified_attack_vector": null, "modified_attack_complexity": null, "modified_attack_requirements": null, "modified_privileges_required": null, "modified_user_interaction": null, "modified_vulnerable_system_confidentiality": null, "modified_vulnerable_system_integrity": null, "modified_vulnerable_system_availability": null, "modified_subsequent_system_confidentiality": null, "modified_subsequent_system_integrity": null, "modified_subsequent_system_availability": null, "safety": null, "automatable": null, "recovery": null, "value_density": null, "vulnerability_response_effort": null, "provider_urgency": null, "base_score": 9.8, "base_severity": "CRITICAL" } } } } ] } ``` ## Related Examples - [Configurations That Need Two Products](/reference/vulnerability/search/examples/configurations-operator/) - [Configuration Nodes That Are Not Negated](/reference/vulnerability/search/examples/configurations-nodes-negate/) - [Configurations Listing a Platform](/reference/vulnerability/search/examples/configurations-nodes-cpe-match-vulnerable/) - [Configurations Matching MOVEit Transfer](/reference/vulnerability/search/examples/configurations-nodes-cpe-match-criteria/) - [One CPE Match Criterion by Id](/reference/vulnerability/search/examples/configurations-nodes-cpe-match-match-criteria-id/) - [Configurations Starting at Version 2.13.0](/reference/vulnerability/search/examples/configurations-nodes-cpe-match-version-start-including/)