PT-2018-18007 · Eq 3 Ag · Homematic Ccu2

Gregor Kopf + 1 · Published 2018-02-22 · Updated 2019-10-03 · CVE-2018-7299

Positive Technologies (AI Summary)

CVSS v3.1

8.0

High

Base vector

AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions eQ-3 AG Homematic CCU2 versions 2.29.2 and earlier

Description The issue allows authenticated attackers to perform Remote Code Execution in the addon installation process. This enables them to create or overwrite arbitrary files or install malicious software on the device.

Recommendations For versions 2.29.2 and earlier, update to a version later than 2.29.2 to resolve the issue.

Fix

Related Identifiers

CVE-2018-7299

Affected Products

Homematic Ccu2

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2018-7299 · Security Note
• https://osv.dev/vulnerability/CVE-2018-7299 · Vendor Advisory
• http://atomic111.github.io/article/homematic-ccu2-untrusted_addon · Note