CVE-2021-33032: Unauthenticated OS command injection in eQ-3 HomeMatic CCU2/CCU3 WebUI

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 20 September 2026. Confidence: high.

critical priorityCVSS 10.0 with network reachability, no authentication, root-level code execution, and a public exploit write-up make this an urgent fix.

What it is

The WebUI component of eQ-3 HomeMatic CCU2 firmware up to 2.57.5 and CCU3 firmware up to 3.57.5 fails to neutralize input passed to system commands, allowing OS command injection. Because the flaw is reachable over the network without credentials, any host that can reach the WebUI can run commands as root on the controller.

Impact

An attacker gains arbitrary command execution as root on the HomeMatic central control unit, giving full control of the device and any smart-home devices and data it manages.

Attack surface

Reachable over the network through the WebUI via a simple HTTP request, per the description. No authentication and no user interaction are required, matching the CVSS vector AV:N/AC:L/PR:N/UI:N.

Exploitation

A public exploit write-up is referenced (Exploit tag), and EPSS is 0.52161 (99th percentile), indicating high predicted exploitation activity. The CVE is not listed in CISA KEV, so no confirmed in-the-wild exploitation is recorded here.

What to do

• Upgrade CCU2 to firmware 2.59.7 or later and CCU3 to firmware 3.59.6 or later, per the vendor changelogs.
• Do not expose the CCU WebUI to the internet; restrict access to a trusted management network or VPN.
• Segment HomeMatic controllers from general user and IoT networks so a compromised controller cannot pivot.
• Monitor vendor advisories for further firmware updates and apply them promptly.

Detection

• Review WebUI/HTTP access logs for requests containing shell metacharacters (;, |, $(), backticks) or unexpected command strings.
• Alert on outbound connections or process execution from the CCU that is not part of normal smart-home operation.
• Baseline and monitor firmware versions of CCU2/CCU3 devices to flag those below the fixed releases.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.