LiveActive security incident?Get immediate response
CVE Record

CVE-2021-33032: A Remote Code Execution (RCE) vulnerability in the WebUI component of the eQ-3 HomeMatic CCU2 firmware up t...

A Remote Code Execution (RCE) vulnerability in the WebUI component of the eQ-3 HomeMatic CCU2 firmware up to and including version 2.57.5 and CCU3 firmware up to and including version 3.57.5 allows remote unauthenticated attackers to execute system commands as root via a simple HTTP request.

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysiscritical

Security readout for executives and security teams

Plain-English summary

This flaw lets an unauthenticated remote attacker run system commands as root through the HomeMatic WebUI. For affected CCU2 and CCU3 controllers, compromise could mean full device control and possible impact to connected smart-home or building automation functions.

Executive priority

Treat this as urgent for any deployed HomeMatic CCU2 or CCU3 controller. Root-level unauthenticated RCE can turn device exposure into full compromise, especially if WebUI is reachable beyond a tightly controlled network.

Technical view

CVE-2021-33032 is an unauthenticated RCE in the WebUI component of eQ-3 HomeMatic CCU2 firmware through 2.57.5 and CCU3 firmware through 3.57.5. The CVE description says a simple HTTP request can execute system commands as root. CVSS, CWE, and structured affected CPE data are absent from the bundle.

Likely exposure

Exposure is likely where HomeMatic CCU2 or CCU3 WebUI is reachable and firmware is at or below the listed affected versions. Internet exposure would materially increase risk. The source bundle does not name other affected products or deployment patterns.

Exploitation context

The CVE description confirms unauthenticated remote command execution as root. KEV is false, and the provided sources do not establish active exploitation in the wild. A public technical write-up is referenced, so defenders should assume exploit knowledge is public.

Researcher notes

The bundle provides strong impact language but lacks CVSS, CWE, CPE, and explicit exploit-in-the-wild evidence. Vendor changelog references are present, but the prompt does not include their contents, so exact fixed-version claims should be verified against vendor documentation.

Mitigation direction

  • Inventory HomeMatic CCU2 and CCU3 controllers and record firmware versions.
  • Update affected CCU2 and CCU3 firmware beyond the vulnerable versions using vendor guidance.
  • Restrict WebUI access to trusted management networks only.
  • Remove any direct internet exposure to the WebUI.
  • Monitor vendor changelogs and advisories for exact remediation details.

Validation and detection

  • Confirm no CCU2 devices run firmware 2.57.5 or earlier.
  • Confirm no CCU3 devices run firmware 3.57.5 or earlier.
  • Verify WebUI is not reachable from untrusted networks.
  • Review access logs for suspicious unauthenticated HTTP requests.
  • Document compensating controls where immediate firmware updates are delayed.
Prepared
Confidence
medium
Sources
5

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

description · low confidence lookup

Execution behavior lookup

The CVE wording references code or command execution, so execution technique review may help defensive triage. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.

Open ATT&CK lookup
cve · low confidence lookup

CVE-2021-33032 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
0Timeline events
0ADP providers
4Source links

CVSS and timeline data

No CVSS vectors or timeline events were available in the normalized CVE source material.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
n/an/an/aListed
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.