CVE-2018-7297: Homematic CCU2 TCL interpreter unauthenticated remote code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: medium.

critical priorityUnauthenticated network-reachable remote code execution with a 9.8 CVSS score and high EPSS probability, though no confirmed patch version is stated in the record.

What it is

The TCL script interpreter in eQ-3 Homematic CCU2 firmware 2.29.2 and earlier allows remote attackers to execute system commands and gain read/write access on the device. The flaw is reachable through the web interface without authentication, making any internet- or network-exposed CCU2 a direct compromise target.

Impact

An attacker gains read/write access to the device and can execute arbitrary system commands, effectively taking full control of the central control unit.

Attack surface

Reached over the network via the CCU2 web interface; the CVSS vector (AV:N/PR:N/UI:N) and the description state no authentication or user interaction is required.

Exploitation

Not listed in CISA KEV, but EPSS is 0.64251 (99.2nd percentile) and public exploit code exists on Exploit-DB (44368), indicating active and easy exploitation.

What to do

• Upgrade Homematic CCU2 firmware beyond 2.29.2 to a vendor-supported release; this is the only complete fix.
• Remove CCU2 web interface exposure from the internet and restrict access to trusted management networks or VPN.
• Segment CCU2 devices from general user and IoT networks to limit lateral movement after compromise.
• Monitor eQ-3 advisories for this product line, as the record does not list a confirmed patched version.
• If patching is not possible, place the web interface behind an authenticating reverse proxy and block direct access.

Detection

• Alert on unexpected outbound connections or command execution from CCU2 devices.
• Review CCU2 web server logs for anomalous requests to TCL interpreter endpoints.
• Hunt for new or modified scripts and unexpected processes on the CCU2 host.
• Monitor for known Exploit-DB 44368 payload patterns in network traffic to the web interface.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.