CVE-2018-7298

In /usr/local/etc/config/addons/mh/loopupd.sh on eQ-3 AG HomeMatic CCU2 2.29.22 devices, software update packages are downloaded via the HTTP protocol, which does not provide any cryptographic protection of the downloaded contents. An attacker with a privileged network position (which could be obtained via DNS spoofing of www.meine-homematic.de or other approaches) can exploit this issue in order to provide arbitrary malicious firmware updates to the CCU2. This can result in a full system compromise.

CVSS v3 8.1 HIGH
CVSS v2.0 9.3 HIGH

8.1^/10

CVSS v3 : HIGH

Vector : AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability : 2.2 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

9.3^/10

CVSS v2.0 : HIGH

Vector : AV:N/AC:M/Au:N/C:C/I:C/A:C

Exploitability : 8.6 / Impact : 10.0

Access Vector NETWORK

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact COMPLETE

Integrity Impact COMPLETE

Availability Impact COMPLETE

References

Link	Resource
http://atomic111.github.io/article/homematic-ccu2-firmware-via-plain-http	Third Party Advisory
http://atomic111.github.io/article/homematic-ccu2-firmware-via-plain-http	Third Party Advisory

Configurations

Configuration 1 (hide)

AND

cpe:2.3:o:eq-3:homematic_central_control_unit_ccu2_firmware:2.29.22:*:*:*:*:*:*:*

cpe:2.3:h:eq-3:homematic_central_control_unit_ccu2:-:*:*:*:*:*:*:*

History

21 Nov 2024, 04:11

Type	Values Removed	Values Added
References	~~() http://atomic111.github.io/article/homematic-ccu2-firmware-via-plain-http - Third Party Advisory~~	() http://atomic111.github.io/article/homematic-ccu2-firmware-via-plain-http - Third Party Advisory

Information

Published : 2018-02-22 19:29

Updated : 2024-11-21 04:11

NVD link : CVE-2018-7298

Mitre link : CVE-2018-7298

CVE.ORG link : CVE-2018-7298

JSON object : View

Products Affected

eq-3

homematic_central_control_unit_ccu2_firmware
homematic_central_control_unit_ccu2

CWE

CWE-319

Cleartext Transmission of Sensitive Information

{"id": "CVE-2018-7298", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 9.3, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:N/C:C/I:C/A:C", "authentication": "NONE", "integrityImpact": "COMPLETE", "accessComplexity": "MEDIUM", "availabilityImpact": "COMPLETE", "confidentialityImpact": "COMPLETE"}, "acInsufInfo": false, "impactScore": 10.0, "baseSeverity": "HIGH", "obtainAllPrivilege": false, "exploitabilityScore": 8.6, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV30": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 8.1, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.2}]}, "published": "2018-02-22T19:29:05.140", "references": [{"url": "http://atomic111.github.io/article/homematic-ccu2-firmware-via-plain-http", "tags": ["Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "http://atomic111.github.io/article/homematic-ccu2-firmware-via-plain-http", "tags": ["Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-319"}]}], "descriptions": [{"lang": "en", "value": "In /usr/local/etc/config/addons/mh/loopupd.sh on eQ-3 AG HomeMatic CCU2 2.29.22 devices, software update packages are downloaded via the HTTP protocol, which does not provide any cryptographic protection of the downloaded contents. An attacker with a privileged network position (which could be obtained via DNS spoofing of www.meine-homematic.de or other approaches) can exploit this issue in order to provide arbitrary malicious firmware updates to the CCU2. This can result in a full system compromise."}, {"lang": "es", "value": "En /usr/local/etc/config/addons/mh/loopupd.sh en dispositivos eQ-3 AG HomeMatic CCU2 2.29.22, los paquetes de actualizaci\u00f3n de software se descargan mediante el protocolo HTTP, que no proporciona protecci\u00f3n criptogr\u00e1fica del contenido descargado. Un atacante con una posici\u00f3n privilegiada de red (que podr\u00eda obtenerse mediante la suplantaci\u00f3n DNS de www.meine-homematic.de o mediante otros m\u00e9todos) puede explotar este problema para proporcionar actualizaciones de firmware maliciosas al CCU2. Esto puede resultar en el compromiso total del sistema."}], "lastModified": "2024-11-21T04:11:57.600", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:eq-3:homematic_central_control_unit_ccu2_firmware:2.29.22:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "51B22E1E-E0C8-46DA-9BE7-3D915B0B056C"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:eq-3:homematic_central_control_unit_ccu2:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "250E0A8B-A3F3-4A65-9C9D-8327EB1D99E5"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "cve@mitre.org"}