Vulnerability Details : CVE-2018-7300
Directory Traversal / Arbitrary File Write / Remote Code Execution in the User.setLanguage method in eQ-3 AG Homematic CCU2 2.29.2 and earlier allows remote attackers to write arbitrary files to the device's filesystem. This vulnerability can be exploited by unauthenticated attackers with access to the web interface.
Vulnerability category: Directory traversalExecute code
Exploit prediction scoring system (EPSS) score for CVE-2018-7300
Probability of exploitation activity in the next 30 days: 2.13%
Percentile, the proportion of vulnerabilities that are scored at or less: ~ 88 % EPSS Score History EPSS FAQ
CVSS scores for CVE-2018-7300
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source |
|---|---|---|---|---|---|
|
10.0
|
HIGH | AV:N/AC:L/Au:N/C:C/I:C/A:C |
10.0
|
10.0
|
NIST |
|
9.8
|
CRITICAL | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
3.9
|
5.9
|
NIST |
CWE ids for CVE-2018-7300
-
The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.Assigned by: nvd@nist.gov (Primary)
References for CVE-2018-7300
-
https://www.exploit-db.com/exploits/44361/
Homematic CCU2 2.29.23 - Arbitrary File WriteThird Party Advisory;VDB Entry
-
http://atomic111.github.io/article/homematic-ccu2-filewrite
CVE-2018-7300: Arbitrary File Upload / Remote Code Execution in HomeMatic CCU2 · Patrick Münch BlogThird Party Advisory
Products affected by CVE-2018-7300
- cpe:2.3:o:eq-3:homematic_ccu2_firmware:*:*:*:*:*:*:*:*