Back to Database
Status published
Medium
CVE-2018-7296
Directory Traversal / Arbitrary File Read in User.getLanguage method in...
Vulnerability Description
Directory Traversal / Arbitrary File Read in User.getLanguage method in eQ-3 AG Homematic CCU2 2.29.2 and earlier allows remote attackers to read the first line of an arbitrary file on the CCU2's filesystem. This vulnerability can be exploited by unauthenticated attackers with access to the web interface.
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
THREAT MONITOR
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2018-7296
Credits & Attribution
No credits recorded in the NVD database.
More from eq-3
View All →CVE-2021-33032
A Remote Code Execution (RCE) vulnerability in the WebUI component...
Critical
10
CVE-2020-12834
eQ-3 Homematic Central Control Unit (CCU)2 through 2.51.6 and CCU3...
Critical
9.8
CVE-2019-9727
Unauthenticated password hash disclosure in the User.getUserPWD method in eQ-3...
High
7.5
CVE-2019-9726
Directory Traversal / Arbitrary File Read in eQ-3 AG Homematic...
High
7.5
CVE-2019-9585
eQ-3 Homematic CCU2 prior to 2.47.10 and CCU3 prior to...
Critical
9.8
Affected Vendor
eq-3
View all reports →Affected Software
homematic central control unit ccu2 firmware
Vulnerable Versions:
0
Timeline
Official Publish:
February 22nd, 2018
Last Modified:
August 5th, 2024
Added to House:
July 20th, 2026
CVSS Vectors
V3:
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Weaknesses (CWE)
No CWE data available
MITRE ATT&CK TTPs
No associated TTPs found for this vulnerability.