published May 15, 2020
🚨 An unauthenticated attacker can hijack your smart home by exploiting a tiny oversight in default settings! 🔥 Think of it like leaving your front door wide open during a party. Everyone can stroll right in without even knocking, and who knows what mischief they could get up to inside your home! An attacker could remotely execute any code through the JSON API, potentially taking control of your smart devices and wreaking havoc on your home automation. This could lead to unauthorized actions like turning on devices or even accessing sensitive data. Yikes!
Think of it like leaving your front door wide open during a party. Everyone can stroll right in without even knocking, and who knows what mischief they could get up to inside your home! This vulnerability resides in eQ-3's Homematic Central Control Unit (CCU)2 and CCU3 due to the default auto-login feature being enabled after initial setup. This allows attackers to execute scripts without authentication via the ReGa.runScript method in the JSON API.
An attacker could remotely execute any code through the JSON API, potentially taking control of your smart devices and wreaking havoc on your home automation. This could lead to unauthorized actions like turning on devices or even accessing sensitive data. Yikes! To secure your system, disable the default auto-login feature immediately. Ensure that you're running the latest firmware version (2.51.7 for CCU2 and 3.51.7 for CCU3) to patch this vulnerability. It's also wise to change any default credentials you may have overlooked! You've got this! Follow these steps and keep your smart home secure. 🛡️