CVE-2018-7300

CVE-2018-7300 is a critical directory traversal and arbitrary file write vulnerability affecting eQ-3 AG Homematic CCU2 devices running firmware version 2.29.2 and earlier. This flaw allows unauthenticated attackers with network access to the web interface to write arbitrary files to the device's filesystem, potentially leading to remote code execution. With a CVSS score of 9.8 (CRITICAL) and a FAUCET Risk Score of 96/100, the vulnerability is easily exploitable over the network with low attack complexity and no user interaction required, resulting in complete compromise of confidentiality, integrity, and availability. While not listed in CISA's KEV catalog, public exploit code is available on ExploitDB, though there is no evidence of widespread active exploitation, Metasploit modules, or significant community discussion or media coverage.