CVE-2024-47944: medium-severity vulnerability in RITTAL GmbH & Co. KG IoT Interface & CMC III…
Missing Protection Mechanism for Alternate Hardware Interface
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
13Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 6.8epss 0.4%
In short
A device allows anyone to upload and run malicious firmware files through a USB stick without requiring a password or login, enabling unauthorized code execution.
Technical detail
The firmware upgrade function in the admin interface lacks authentication mechanisms, allowing unauthenticated attackers to execute arbitrary code by providing crafted .patch files via USB interface. This bypasses the alternate hardware interface protection, resulting in complete system compromise.
Summary generated and translated by AI from the official description.
The device directly executes .patch firmware upgrade files on a USB stick without any prior authentication in the admin interface. This leads to an unauthenticated code execution via the firmware upgrade function.
CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products
RITTAL GmbH & Co. KG · IoT Interface & CMC III Processing UnitRelated CVEs — RITTAL GmbH & Co. KG IoT Interface & CMC III…
In the same product, most dangerous first.