CVE-2018-7300 - CVE House
Back to Database
Status published Critical CVE-2018-7300

Directory Traversal / Arbitrary File Write / Remote Code Execution...

Vulnerability Description

Directory Traversal / Arbitrary File Write / Remote Code Execution in the User.setLanguage method in eQ-3 AG Homematic CCU2 2.29.2 and earlier allows remote attackers to write arbitrary files to the device's filesystem. This vulnerability can be exploited by unauthenticated attackers with access to the web interface.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2018-7300

Credits & Attribution

No credits recorded in the NVD database.

References

More from eq-3

View All →
CVE-2021-33032
A Remote Code Execution (RCE) vulnerability in the WebUI component...
Critical 10
CVE-2020-12834
eQ-3 Homematic Central Control Unit (CCU)2 through 2.51.6 and CCU3...
Critical 9.8
CVE-2019-9727
Unauthenticated password hash disclosure in the User.getUserPWD method in eQ-3...
High 7.5
CVE-2019-9726
Directory Traversal / Arbitrary File Read in eQ-3 AG Homematic...
High 7.5
CVE-2019-9585
eQ-3 Homematic CCU2 prior to 2.47.10 and CCU3 prior to...
Critical 9.8

Affected Vendor

Affected Software

homematic ccu2 firmware
Vulnerable Versions:
0

Timeline

Official Publish: February 22nd, 2018
Last Modified: August 5th, 2024
Added to House: July 20th, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weaknesses (CWE)

No CWE data available

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.