CVE-2021-33032

eQ-3 HomeMatic CCU2 2.57.5 and CCU3 3.57.5 devices allow remote code execution.

10.0 Critical

A Remote Code Execution (RCE) vulnerability in the WebUI component of the eQ-3 HomeMatic CCU2 firmware up to and including version 2.57.5 and CCU3 firmware up to and including version 3.57.5 allows remote unauthenticated attackers to execute system commands as root via a simple HTTP request.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: High
Integrity: High
Availability: High

Exploit likelihood

52.2%Up 50.3 points since Jul 23, 2021

What each source reports

NVD Score used 10.0

Record: CVE-2021-33032
CVSS 3.1: 10.0 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
CVSS 2.0: 10.0 HighAV:N/AC:L/Au:N/C:C/I:C/A:C
Weakness: CWE-78
Updated: 2026-11-02

CVE List No score

Record: CVE-2021-33032
Updated: 2026-11-02

EUVDEUVD-2021-19752 No score

Record: EUVD-2021-19752
Updated: 2026-11-03

GitHub AdvisoriesGHSA-r7xr-9q5c-fh23 No score

eQ-3 HomeMatic CCU2 2.57.5 and CCU3 3.57.5 devices allow remote code execution.

eQ-3 HomeMatic CCU2 2.57.5 and CCU3 3.57.5 devices allow remote code execution.

Record: GHSA-r7xr-9q5c-fh23
Weakness: CWE-78
Updated: 2026-11-02

Affected products

History

History
Recorded	Changed	Sources
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	first indexed	CVE List, GitHub Advisories, NVD

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2021-33032 is a critical vulnerability (CVSS 10.0) in Eq-3 Homematic Ccu2 Firmware, published July 22, 2021. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 52.2%, the 98th percentile. No source names a fixed version.