CVE-2018-7301 eQ-3 AG HomeMatic CCU2 2.29.22 devices have an open XML-RPC port without authentication. This can be exploited by sending arbitrary XML-RPC requests to control the attached BidCos devices.
CriticalCVSS 9.8
EPSS 1.5%
- Published
- Updated
- Exploit status
- No public exploit known
Description
eQ-3 AG HomeMatic CCU2 2.29.22 devices have an open XML-RPC port without authentication. This can be exploited by sending arbitrary XML-RPC requests to control the attached BidCos devices.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| eq-3 homematic central control unit ccu2 firmware | = 2.29.22 | No fix listed |
References
- atomic111.github.io third-party-advisory