CVE-2018-7297

This bug is like a “hidden command” inside the CCU2’s scripting feature. If someone can reach its web interface, they can potentially make the device run commands as if they were an administrator, which can break your smart automation and potentially let attackers pivot further into your systems.

This matters if your business uses an eQ-3 AG Homematic CCU2 (HomeMatic Central Control Unit 2) running firmware up to and including 2.29.2. It’s especially a concern if your CCU2 web interface can be reached from outside your local network, because remote attackers do not need to be logged in to attempt exploitation via the web interface.

This is RED because public exploit code exists and the reported likelihood signals are rising, meaning real attacks are plausible. Treat any internet-reachable CCU2 web interface as a likely path for compromise and act immediately to cut exposure and upgrade once the fix is available.

1. Confirm your setup

• Identify your device model (Homematic Central Control Unit 2 / CCU2).
• Check the installed firmware version. This issue applies to CCU2 firmware 2.29.2 and earlier.

2. Determine exposure (this vulnerability is reachable via the web interface)

• From outside your office network (e.g., using your phone on cellular), try accessing the CCU2 web interface URL.
• If you can reach it without a corporate VPN/firewall restriction, it is exposed.

3. Immediate containment if exposed

• Block inbound internet access to the CCU2 web interface at your firewall/router.
• Allow access only from trusted local IP addresses and/or via a VPN.
• If you use port forwarding, remove/disable the public mapping for the CCU2 web interface.

4. Patch/upgrade

• Upgrade CCU2 firmware using the fixed version released by eQ-3 for CVE-2018-7297.
• The provided sources confirm that vendor remediation exists but do not list the exact fixed firmware number; use the eQ-3 security advisory/release notes for your current firmware line to select the correct “fixed” upgrade.

5. Verification after upgrade

• Re-test from outside your network to ensure the web interface remains blocked/restricted.
• Confirm the CCU2 services (automation/controls) still function normally.

6. If you cannot update right away

• Keep the web interface non-internet-reachable (restrict use until the vendor-provided update is available, consistent with the vendor’s remediation guidance).

7. What to monitor

• Monitor router/firewall logs for repeated requests to the CCU2 web endpoint from unusual sources.
• Review CCU2/admin logs for suspicious activity after any exposure window.

8. KEV / timelines

• This CVE is not listed in the CISA KEV set per the provided findings, so do not rely on KEV status as your only urgency signal.

Severity: Critical in scoring provided (CVSS 9.8). This is a Remote Code Execution issue in the TCL script interpreter on eQ-3 AG Homematic CCU2 firmware. Mechanism: a remote attacker can use the web interface (unauthenticated) to obtain read/write access and execute system commands on the device. Exploitation status: public exploit code is available (one known public exploit). Exposure signals: predicted exploitation likelihood is rising per the provided EPSS findings (the exact percentage is not repeated here). KEV status: not listed in CISA KEV per the provided findings. Practical attack vector: reach the CCU2 web interface from the network path available to the attacker; if the device is directly internet-accessible, the reachability threshold is met.