CVE-2018-7301: Eq-3 Homematic Central Control Unit CCU2 Firmware

Critical severity, CVSS 9.8. EPSS: 1.5% chance of exploitation in the next 30 days.

eQ-3 AG HomeMatic CCU2 2.29.22 devices have an open XML-RPC port without authentication. This can be exploited by sending arbitrary XML-RPC requests to control the attached BidCos devices.

Affected products

• Eq-3 Homematic Central Control Unit CCU2 Firmware: version 2.29.22 only

Published 2018-02-22. Last modified 2026-06-17.