PT-2018-1169 · Eq 3 Ag · Homematic Ccu2

Gregor Kopf + 1 · Published 2018-02-21 · Updated 2019-10-03 · CVE-2018-7297

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions eQ-3 AG Homematic CCU2 versions 2.29.2 and earlier

Description The issue is related to a Remote Code Execution vulnerability in the TCL script interpreter. This allows remote attackers to obtain read/write access and execute system commands on the device. The vulnerability can be exploited by unauthenticated attackers with access to the web interface. It is associated with shortcomings in the security mechanisms of the TCL script interpreter, enabling remote attackers to read and write arbitrary files and execute system commands on the device using the web interface.

Recommendations For versions 2.29.2 and earlier, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Weakness Enumeration

CWE-264

Related Identifiers

BDU:2018-00618

CVE-2018-7297

Affected Products

Homematic Ccu2

References · 5

• 🔥 https://exploit-db.com/exploits/44368 · Exploit
• https://osv.dev/vulnerability/CVE-2018-7297 · Vendor Advisory
• https://bdu.fstec.ru/vul/2018-00618 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2018-7297 · Security Note
• http://atomic111.github.io/article/homematic-ccu2-remote-code-execution · Note