vulnwire
9.8crit

CVE-2018-7300in critical feed1 exploit

Directory Traversal / Arbitrary File Write / Remote Code Execution in the User.setLanguage method in eQ-3 AG Homematic CCU2 2.29.2 and earl…

Published 8 y ago · modified 4 mo ago · JSON

CVSS
9.8
v3.1 · NVD
CISA KEV
No
not known exploited
EPSS
30.6%
percentile 98%
Public exploits
1
Exploit-DB

Directory Traversal / Arbitrary File Write / Remote Code Execution in the User.setLanguage method in eQ-3 AG Homematic CCU2 2.29.2 and earlier allows remote attackers to write arbitrary files to the device's filesystem. This vulnerability can be exploited by unauthenticated attackers with access to the web interface.

Exploit prediction (EPSS)

30.59% probability of exploitation in the next 30 days, higher than 98% of all scored CVEs.

Exploits and detections

  • EDB-44361 Homematic CCU2 2.29.23 - Arbitrary File Write · webapps · 2018-03-30

CVSS scores

Assigned byVersionScoreVector
NVD3.19.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD2.010.0AV:N/AC:L/Au:N/C:C/I:C/A:C

Classification

Weakness
  • CWE-22 Improper Limitation of a Pathname to a Restricted Directory

References

  • atomic111.github.io /article/homematic-ccu2-filewrite · x_refsource_MISC, x_transferred
  • exploit-db.com /exploits/44361/ · exploit, x_refsource_EXPLOIT-DB, x_transferred

Sources

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.