CVE-2018-7297: Eq-3 Homematic Central Control Unit CCU2 Firmware

Critical severity, CVSS 9.8. EPSS: 64.3% chance of exploitation in the next 30 days.

Remote Code Execution in the TCL script interpreter in eQ-3 AG Homematic CCU2 2.29.2 and earlier allows remote attackers to obtain read/write access and execute system commands on the device. This vulnerability can be exploited by unauthenticated attackers with access to the web interface.

Affected products

• Eq-3 Homematic Central Control Unit CCU2 Firmware: up to and including 2.29.22

Published 2018-02-22. Last modified 2026-06-17.