CVE-2021-33032

What it actually does

CVE-2021-33032 is an unauthenticated remote command injection vulnerability in the WebUI component of eQ-3 HomeMatic CCU2 firmware up to and including 2.57.5 and CCU3 firmware up to and including 3.57.5. Because the WebUI improperly handles attacker-controlled HTTP input, a remote network attacker can inject operating-system commands that are executed as root. The CVSS 10.0 rating reflects network reachability, no authentication or user interaction requirement, low attack complexity, and full confidentiality, integrity, and availability impact. Public exploit code is available and EPSS is elevated at 0.52161, indicating meaningful likelihood of exploitation if exposed.

Why it matters to the business

Successful exploitation gives an attacker full administrative control over the HomeMatic central control unit. In practice, this can disrupt building automation, smart home controls, access-related integrations, alarms, heating, lighting, and other connected devices managed through the CCU. Attackers may also use the compromised appliance as a foothold into adjacent networks, disable automation, alter device behavior, steal configuration data, or install persistence. Although this vulnerability is not currently listed in CISA KEV and is not known from the provided data to be ransomware-associated, public exploit availability and the age of the issue make internet-exposed or poorly segmented devices high-risk.

How an attack unfolds

An attacker first identifies a reachable HomeMatic CCU2 or CCU3 WebUI instance, commonly through internet scanning, local network discovery, or targeting known automation deployments. The attacker determines that the device is running a vulnerable firmware release at or below CCU2 2.57.5 or CCU3 3.57.5. They then send a crafted unauthenticated HTTP request to the WebUI containing shell command syntax in a vulnerable parameter or request component. The WebUI passes the malicious input to the underlying operating system without proper sanitization, causing the command to execute as root. From there, the attacker can retrieve configuration data, modify automation settings, run additional commands, download tools, create persistence, pivot to other systems, or disrupt the availability and behavior of connected automation devices.

How to fix it

Upgrade affected eQ-3 HomeMatic CCU2 and CCU3 devices to a vendor-supported firmware version newer than the vulnerable ranges: CCU2 firmware must be upgraded from 2.57.5 or earlier, and CCU3 firmware must be upgraded from 3.57.5 or earlier. If immediate upgrade is not possible, restrict WebUI access to trusted management networks only, block internet exposure, require VPN or other authenticated network access before reaching the WebUI, and apply firewall rules that deny untrusted inbound HTTP/HTTPS access to the device. Place HomeMatic controllers on a segmented network with minimal access to business systems. Review installed add-ons, startup scripts, and device configuration after patching because exploitation runs as root and may survive a simple reboot.

How to confirm the fix worked

Confirm the running firmware version through the HomeMatic WebUI or device management interface and verify it is newer than CCU2 2.57.5 or CCU3 3.57.5. Perform an external and internal network scan to ensure the WebUI is not reachable from untrusted networks. Validate firewall and segmentation controls by attempting to access the WebUI from non-management network segments. If a vulnerability scanner is used, ensure it checks the HomeMatic CCU model and firmware version rather than relying only on open ports. After remediation, review device integrity by checking for unexpected startup scripts, modified configuration, unknown add-ons, unusual outbound connections, and suspicious processes running under root.

Typical attack path

1. Discover a reachable eQ-3 HomeMatic CCU2 or CCU3 WebUI service.
2. Fingerprint the device model and firmware version to confirm it is at or below CCU2 2.57.5 or CCU3 3.57.5.
3. Send a crafted unauthenticated HTTP request containing operating-system command metacharacters or encoded shell syntax to the vulnerable WebUI component.
4. Execute commands as root on the CCU appliance.
5. Perform post-exploitation actions such as reading configuration files, modifying automation logic, downloading payloads, establishing persistence, or using the device as a network foothold.
6. Optionally disrupt connected automation devices or erase evidence from local logs.

How to detect it

Investigate WebUI access logs, system logs, firewall logs, proxy logs, and network telemetry for suspicious unauthenticated HTTP requests to HomeMatic CCU2 or CCU3 devices, especially requests containing shell metacharacters, URL-encoded command separators, or attempts to invoke download-and-execute behavior. On the device, review system logs such as /var/log/messages where available, WebUI or HTTP daemon logs, shell history if present, modified files under persistent configuration and startup locations, unexpected add-ons, and unusual processes running as root. Look for outbound connections shortly after suspicious WebUI requests, especially to unknown internet hosts over HTTP, HTTPS, wget, curl, telnet, netcat, or busybox-related commands. Because exploitation executes as root, absence of logs is not conclusive; also compare current configuration, startup scripts, add-on directories, and firmware state against known-good baselines or backups.

• HTTP requests to HomeMatic WebUI containing "%3B"
• HTTP requests to HomeMatic WebUI containing "%7C"
• HTTP requests to HomeMatic WebUI containing "%60"
• HTTP requests to HomeMatic WebUI containing "%24%28"
• HTTP requests to HomeMatic WebUI containing "%26%26"
• HTTP requests to HomeMatic WebUI containing ";wget"
• HTTP requests to HomeMatic WebUI containing ";curl"
• HTTP requests to HomeMatic WebUI containing "|wget"
• HTTP requests to HomeMatic WebUI containing "|curl"
• HTTP requests to HomeMatic WebUI containing "busybox"
• HTTP requests to HomeMatic WebUI containing "nc%20"
• HTTP requests to HomeMatic WebUI containing "netcat"
• Unexpected files or scripts under /usr/local/etc/config/rc.d/
• Unexpected files or scripts under /usr/local/addons/
• Unexpected modifications to /etc/rc.local
• Unexpected root-owned executable files under /tmp/
• Unexpected outbound connections from the CCU process host immediately after WebUI HTTP requests
• Processes named wget spawned on the CCU appliance
• Processes named curl spawned on the CCU appliance
• Processes named nc spawned on the CCU appliance
• Processes named netcat spawned on the CCU appliance
• Processes named busybox spawned with shell or network arguments

What your security team should do

• Immediately inventory all eQ-3 HomeMatic CCU2 and CCU3 devices and record firmware versions and network exposure.
• Prioritize internet-exposed or cross-segment reachable devices for urgent isolation and firmware upgrade because exploitation is unauthenticated, remote, and public exploit code exists.
• Upgrade CCU2 firmware from 2.57.5 or earlier and CCU3 firmware from 3.57.5 or earlier to a supported non-vulnerable release.
• Remove direct internet access to the WebUI; require VPN, jump host, or trusted management network access.
• Review logs and device state for prior exploitation before assuming patching alone is sufficient.
• Inspect persistence locations, installed add-ons, startup scripts, and scheduled tasks for unauthorized changes.
• Monitor for outbound connections from HomeMatic controllers to unknown external IP addresses or domains.
• Segment HomeMatic automation infrastructure from user workstations, servers, and sensitive business networks.
• If compromise is suspected, preserve logs and configuration, rebuild or factory-reset the device from trusted firmware, rotate any credentials or tokens stored on or used by the controller, and re-import only verified-clean configuration.