CVE-2021-33032: Eq-3 Homematic CCU2 Firmware

Critical severity, CVSS 10.0. EPSS: 52.2% chance of exploitation in the next 30 days.

A Remote Code Execution (RCE) vulnerability in the WebUI component of the eQ-3 HomeMatic CCU2 firmware up to and including version 2.57.5 and CCU3 firmware up to and including version 3.57.5 allows remote unauthenticated attackers to execute system commands as root via a simple HTTP request.

Affected products

• Eq-3 Homematic CCU2 Firmware: up to and including 2.57.5
• Eq-3 Homematic CCU3 Firmware: up to and including 3.57.5

Published 2021-07-22. Last modified 2026-06-17.