CVE-2024-47943criticalCWE-347

CVE-2024-47943: critical vulnerability in RITTAL GmbH & Co. KG IoT Interface & CMC III…

Improper signature verification of firmware upgrade files

Published · Updated

Follow this CVE+ Monitor IoT Interface & CMC III Processing Unit

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

28Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 9.8epss 0.6%
In short

The Rittal device accepts firmware updates with fake signatures because the signing key is publicly available in the downloadable firmware. An attacker can create malicious updates that the device will execute, gaining complete control.

Technical detail

The firmware upgrade mechanism uses HMAC-based signature verification with a hardcoded key exposed in publicly available firmware files. An unauthenticated attacker can forge valid signatures for arbitrary patch files containing malicious run.sh scripts, achieving remote code execution on the device.

Summary generated and translated by AI from the official description.
The firmware upgrade function in the admin web interface of the Rittal IoT Interface & CMC III Processing Unit devices checks if the patch files are signed before executing the containing run.sh script. The signing process is kind of an HMAC with a long string as key which is hard-coded in the firmware and is freely available for download. This allows crafting malicious "signed" .patch files in order to compromise the device and execute arbitrary code.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products
RITTAL GmbH & Co. KG · IoT Interface & CMC III Processing Unit
Related CVEs — RITTAL GmbH & Co. KG IoT Interface & CMC III…

In the same product, most dangerous first.

CVE-2024-47945CRITICALPredictable Session IDEPSS 0.9%CVE-2024-47944MEDIUMMissing Protection Mechanism for Alternate Hardware InterfaceEPSS 0.4%