CVE-2019-13030

Published: Aug 14, 2019Modified: Jun 17, 2026

8.2

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H

Exploitability: 3.9 / Impact: 4.2

Source: NVD

Description

eQ-3 Homematic CCU3 AddOn 'Mediola NEO Server for Homematic CCU3' prior to 2.4.5 allows uncontrolled admin access to start or stop the Node.js process, resulting in the ability to obtain mediola configuration details. This is related to improper access control for addons configuration pages and a missing check in rc.d/97NeoServer.

Affected (1)

Products: Mediola: Neo Server

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Mediola Neo Server	Before 2.4.5

Related CWEs

Direct Request ('Forced Browsing')

The web application does not adequately enforce appropriate authorization on all restricted URLs, scripts, or files.

References (4)

https://github.com/psytester/psytester.github.io/blob/master/_posts/hacking_and_pentests/CVEs/2019-06-29-CVE-2019-13030.md

Source: cve@mitre.org

ExploitThird Party Advisory

https://psytester.github.io/CVE-2019-13030/

Source: cve@mitre.org

ExploitThird Party Advisory

https://github.com/psytester/psytester.github.io/blob/master/_posts/hacking_and_pentests/CVEs/2019-06-29-CVE-2019-13030.md

Source: af854a3a-2127-422b-91ae-364da2661108

ExploitThird Party Advisory

https://psytester.github.io/CVE-2019-13030/

Source: af854a3a-2127-422b-91ae-364da2661108

ExploitThird Party Advisory

Timeline

No history available yet.