CVE-2018-7297

CVE-2018-7297 affects eQ-3 Homematic CCU2 (firmware 2.29.2 and earlier). The vulnerability exists in the TCL script interpreter, enabling remote code execution via unauthenticated access to the device’s web interface, allowing read/write access and command execution on the host. Reported via mult...

CVE-2018-7298

In /usr/local/etc/config/addons/mh/loopupd.sh on eQ-3 AG HomeMatic CCU2 2.29.22 devices, software update packages are downloaded via the HTTP protocol, which does not provide any cryptographic protection of the downloaded contents. An attacker with a privileged network position which could be...

CVE-2018-7298

Affected product: eQ-3 AG HomeMatic CCU2 (version 2.29.22). Issue: loopupd.sh downloads software update packages over HTTP, which provides no cryptographic protection. Root cause: lack of integrity/ authenticity verification for firmware updates due to plain HTTP delivery. Impact: attacker with n...

HomeMatic Default Credentials (SSH)

The remote HomeMatic device is using known default credentials. SPDX-FileCopyrightText: 2015 SCHUTZWERK GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later ifdescription...

HomeMatic WebUI Detection

The script sends a HTTP request to the server and attempts to extract the version from the reply. SPDX-FileCopyrightText: 2015 SCHUTZWERK GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier:...