PT-2018-1169 · Eq 3 Ag · Homematic Ccu2

Gregor Kopf + 1 · Publicado 2018-02-21 · Atualizado 2019-10-03 · CVE-2018-7297

Positive Technologies (AI Summary)

CVSS v2.0

10

Crítica

Vetor base

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions eQ-3 AG Homematic CCU2 versions 2.29.2 and earlier

Description The issue is related to a Remote Code Execution vulnerability in the TCL script interpreter. This allows remote attackers to obtain read/write access and execute system commands on the device. The vulnerability can be exploited by unauthenticated attackers with access to the web interface. It is associated with shortcomings in the security mechanisms of the TCL script interpreter, enabling remote attackers to read and write arbitrary files and execute system commands on the device using the web interface.

Recommendations For versions 2.29.2 and earlier, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Enumeração de Fraquezas

CWE-264

Identificadores relacionados

BDU:2018-00618

CVE-2018-7297

Produtos afetados

Homematic Ccu2

Referências · 5

• 🔥 https://exploit-db.com/exploits/44368 · Exploit
• https://osv.dev/vulnerability/CVE-2018-7297 · Aviso do Fabricante
• https://bdu.fstec.ru/vul/2018-00618 · Nota de Segurança
• https://nvd.nist.gov/vuln/detail/CVE-2018-7297 · Nota de Segurança
• http://atomic111.github.io/article/homematic-ccu2-remote-code-execution · Nota