fkie_cve-2024-47943
Vulnerability from fkie_nvd
Published
2024-10-15 09:15
Modified
2025-03-17 16:15
Severity ?
9.8 (Critical) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Summary
The firmware upgrade function in the admin web interface of the Rittal IoT Interface & CMC III Processing Unit devices checks if the patch files are signed before executing the containing run.sh script. The signing process is kind of an HMAC with a long string as key which is hard-coded in the firmware and is freely available for download. This allows crafting malicious "signed" .patch files in order to compromise the device and execute arbitrary code.
References
551230f0-3615-47bd-b7cc-93e92e730bbfhttps://r.sec-consult.com/rittaliot
551230f0-3615-47bd-b7cc-93e92e730bbfhttps://www.rittal.com/de-de/products/deep/3124300
Impacted products
Vendor Product Version


To clipboard 

{
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "The firmware upgrade function in the admin web interface of the Rittal\u00a0IoT Interface \u0026 CMC III Processing Unit devices checks if \nthe patch files are signed before executing the containing run.sh \nscript. The signing process is kind of an HMAC with a long string as key\n which is hard-coded in the firmware and is freely available for \ndownload. This allows crafting malicious \"signed\" .patch files in order \nto compromise the device and execute arbitrary code."
    },
    {
      "lang": "es",
      "value": "La funci\u00f3n de actualizaci\u00f3n de firmware en la interfaz web de administraci\u00f3n de los dispositivos Rittal IoT Interface \u0026amp; CMC III Processing Unit comprueba si los archivos de parche est\u00e1n firmados antes de ejecutar el script run.sh que los contiene. El proceso de firma es una especie de HMAC con una cadena larga como clave que est\u00e1 codificada en el firmware y est\u00e1 disponible de forma gratuita para su descarga. Esto permite manipular archivos .patch \"firmados\" maliciosos para comprometer el dispositivo y ejecutar c\u00f3digo arbitrario."
    }
  ],
  "id": "CVE-2024-47943",
  "lastModified": "2025-03-17T16:15:23.143",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 9.8,
          "baseSeverity": "CRITICAL",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 5.9,
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "type": "Secondary"
      }
    ]
  },
  "published": "2024-10-15T09:15:03.357",
  "references": [
    {
      "source": "551230f0-3615-47bd-b7cc-93e92e730bbf",
      "url": "https://r.sec-consult.com/rittaliot"
    },
    {
      "source": "551230f0-3615-47bd-b7cc-93e92e730bbf",
      "url": "https://www.rittal.com/de-de/products/deep/3124300"
    }
  ],
  "sourceIdentifier": "551230f0-3615-47bd-b7cc-93e92e730bbf",
  "vulnStatus": "Awaiting Analysis",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-347"
        }
      ],
      "source": "551230f0-3615-47bd-b7cc-93e92e730bbf",
      "type": "Secondary"
    }
  ]
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.