EQ-3 Homematic CCU2

EQ-3 Homematic CCU2
Security Grade D Calculator v1	eQ-3 Homematic CCU2 Brand: eQ-3 (Parent: eQ-3 AG) Category: Smart home control unit • Model / Gen: Homematic CCU2 (predecessor of CCU3) Homematic CCU2 Release Date: 2013 • Status: Discontinued (CCU3 is current) Classification Date: 2026-10-22 • Official Website

Security Evaluation

1. Device Security

Criterion	Value	Proof	Comment
Known hardware tampering	Rare	🔗 Proof	ESET teardown found accessible internal interfaces, but the unit is normally indoors and not routinely opened.
Known vulnerabilities	Very common	[1] 🔗 Proof	Numerous CVEs: unauthenticated file write and RCE in CVE-2018-7300, missing authorization with session IDs in CVE-2019-14475, plus other 2018-2019 issues.
Prior attacks	Rare	🔗 Proof	Research and CVE exploitation exist, but no public mass botnet campaign against CCU2.
Updatability	Rare	🔗 Proof	Security fixes were released, for example 2.47.20, but CCU2 is the older generation and no longer the vendor's current platform.
Category Score	Score: 3 / 3

2. System Security

Criterion	Value	Proof	Comment
Authentication with other systems	Partial	🔗 Proof	XML-RPC and web services expose functionality with weak or missing authorization checks.
Communications	Encrypted with obselete encryption	🔗 Proof	The WebUI is served over HTTP and some internal channels are unencrypted.
Storage	Encrypted with obselete encryption	🔗 Proof	Configuration and user data are stored locally without strong encryption and firmware analysis exposed credentials.
Category Score	Score: 2 / 3

3. User Authentication

Criterion	Value	Proof	Comment
Account management	Basic	🔗 Proof	User accounts exist in the WebUI, but no documented role hierarchy.
Authentication	Basic	🔗 Proof	Session IDs are used for authentication but authorization checks are missing, allowing privilege abuse.
Brute-force protection	Absent	🔗 Proof	Session-ID and unauthenticated endpoints bypass normal login guessing limits and no reliable lockout is documented.
Event logging	Partial logging	🔗 Proof	System protocol and service messages are logged, but there is no complete access audit log.
Passwords	Require change after setup	🔗 Proof	User sets the WebUI password and no factory default admin password is documented.
Category Score	Score: 3 / 3

Technical Specifications

Property	Details
Operating System & App	Homematic CCU firmware (Linux-based) (Companion App: Homematic IP app / WebUI)
Hardware (CPU / GPU)	CPU: • GPU:
Memory & Storage	Memory: • Storage:
Power, Battery & Charging	Battery: • Power: • Charging:
Display & Camera	Display: • Camera:
Sound & Connectivity	Sound: • Connectivity: Ethernet, 868 MHz bidirectional, USB
Physical (Dimensions & Mass)	Dimensions: • Mass: