CVE-2018-7298 describes a critical vulnerability in eQ-3 AG HomeMatic CCU2 devices (firmware 2.29.22 and earlier) where software updates are downloaded insecurely via HTTP, lacking cryptographic protection. An attacker in a privileged network position could exploit this by intercepting and replacing legitimate updates with malicious firmware, leading to a full system compromise. This high-severity vulnerability (CVSS 8.1) requires a high attack complexity but has no user interaction, and there is currently no evidence of active exploitation, public exploit code, or significant community discussion.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
2.29.22CPE matchmatch criteria | cpe:2.3:o:eq-3:homematic_central_control_unit_ccu2_firmware:2.29.22:*:*:*:*:*:*:* |
CVSS version used by this source: 3.0
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.1 Bluesky, 0.1 Mastodon, and 0.2 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Remediation records are not available for this CVE.