fkie_nvd - fkie_cve-2024-47944

fkie_cve-2024-47944

Vulnerability from fkie_nvd

Published

2024-10-15 09:15

Modified

2024-10-15 16:35

Severity ?

6.8 (Medium) - CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Summary

The device directly executes .patch firmware upgrade files on a USB stick without any prior authentication in the admin interface. This leads to an unauthenticated code execution via the firmware upgrade function.

References

▶	URL	Tags
	551230f0-3615-47bd-b7cc-93e92e730bbf	https://r.sec-consult.com/rittaliot
	551230f0-3615-47bd-b7cc-93e92e730bbf	https://www.rittal.com/de-de/products/deep/3124300

Impacted products

	Vendor	Product	Version

To clipboard

{
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "The device directly executes .patch firmware upgrade files on a USB stick without any prior authentication in the admin interface. This leads to an unauthenticated code execution via the\u00a0firmware upgrade function."
    },
    {
      "lang": "es",
      "value": "El dispositivo ejecuta directamente los archivos de actualizaci\u00f3n de firmware .patch en una memoria USB sin ninguna autenticaci\u00f3n previa en la interfaz de administraci\u00f3n. Esto da lugar a una ejecuci\u00f3n de c\u00f3digo no autenticado a trav\u00e9s de la funci\u00f3n de actualizaci\u00f3n de firmware."
    }
  ],
  "id": "CVE-2024-47944",
  "lastModified": "2024-10-15T16:35:09.410",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "PHYSICAL",
          "availabilityImpact": "HIGH",
          "baseScore": 6.8,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 0.9,
        "impactScore": 5.9,
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "type": "Secondary"
      }
    ]
  },
  "published": "2024-10-15T09:15:03.580",
  "references": [
    {
      "source": "551230f0-3615-47bd-b7cc-93e92e730bbf",
      "url": "https://r.sec-consult.com/rittaliot"
    },
    {
      "source": "551230f0-3615-47bd-b7cc-93e92e730bbf",
      "url": "https://www.rittal.com/de-de/products/deep/3124300"
    }
  ],
  "sourceIdentifier": "551230f0-3615-47bd-b7cc-93e92e730bbf",
  "vulnStatus": "Awaiting Analysis",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-1299"
        }
      ],
      "source": "551230f0-3615-47bd-b7cc-93e92e730bbf",
      "type": "Secondary"
    }
  ]
}

CVE-2024-47944 (GCVE-0-2024-47944)

Vulnerability from cvelistv5

Published

2024-10-15 09:00

Modified

2024-10-15 15:45

Severity ?

6.8 (Medium) - CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CWE

CWE-1299 - Missing Protection Mechanism for Alternate Hardware Interface

Summary

The device directly executes .patch firmware upgrade files on a USB stick without any prior authentication in the admin interface. This leads to an unauthenticated code execution via the firmware upgrade function.

References

►

URL

Tags

	https://r.sec-consult.com/rittaliot	third-party-advisory
	https://www.rittal.com/de-de/products/deep/3124300	patch

Impacted products

	Vendor	Product	Version
	RITTAL GmbH & Co. KG	IoT Interface & CMC III Processing Unit	Version: <6.21.00.2 <

Show details on NVD website

To clipboard

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:a:rittal_gmbh_and_co.kg:iot_interface_and_cmc_iii_processing_unit:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "iot_interface_and_cmc_iii_processing_unit",
            "vendor": "rittal_gmbh_and_co.kg",
            "versions": [
              {
                "lessThan": "6.21.00.2",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          }
        ],
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "PHYSICAL",
              "availabilityImpact": "HIGH",
              "baseScore": 6.8,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2024-47944",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-10-15T15:43:38.181689Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-10-15T15:45:06.397Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "affected",
          "product": "IoT Interface \u0026 CMC III Processing Unit",
          "vendor": "RITTAL GmbH \u0026 Co. KG",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c6.21.00.2",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Johannes Kruchem, SEC Consult Vulnerability Lab"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003e\u003c/p\u003e\u003cp\u003eThe device directly executes .patch firmware upgrade files on a USB stick without any prior authentication in the admin interface. This leads to an unauthenticated code execution via the\u0026nbsp;\u003cspan style=\"background-color: var(--wht);\"\u003efirmware upgrade function.\u003c/span\u003e\u003c/p\u003e\u003cp\u003e\u003c/p\u003e\u003cp\u003e\u003c/p\u003e"
            }
          ],
          "value": "The device directly executes .patch firmware upgrade files on a USB stick without any prior authentication in the admin interface. This leads to an unauthenticated code execution via the\u00a0firmware upgrade function."
        }
      ],
      "exploits": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "SEC Consult has published proof of concept code for this vulnerability."
            }
          ],
          "value": "SEC Consult has published proof of concept code for this vulnerability."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-186",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-186 Malicious Software Update"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-1299",
              "description": "CWE-1299: Missing Protection Mechanism for Alternate Hardware Interface",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-10-15T09:00:30.605Z",
        "orgId": "551230f0-3615-47bd-b7cc-93e92e730bbf",
        "shortName": "SEC-VLab"
      },
      "references": [
        {
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://r.sec-consult.com/rittaliot"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://www.rittal.com/de-de/products/deep/3124300"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eThe vendor provides a patched version V6.21.00.2 which can be downloaded from the following URL:\u0026nbsp;\u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://www.rittal.com/de-de/products/deep/3124300\"\u003ewww.rittal.com/de-de/products/deep/3124300\u003c/a\u003e\u003c/p\u003e\u003cbr\u003e"
            }
          ],
          "value": "The vendor provides a patched version V6.21.00.2 which can be downloaded from the following URL:\u00a0 www.rittal.com/de-de/products/deep/3124300 https://www.rittal.com/de-de/products/deep/3124300"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Missing Protection Mechanism for Alternate Hardware Interface",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "551230f0-3615-47bd-b7cc-93e92e730bbf",
    "assignerShortName": "SEC-VLab",
    "cveId": "CVE-2024-47944",
    "datePublished": "2024-10-15T09:00:30.605Z",
    "dateReserved": "2024-10-07T13:39:52.543Z",
    "dateUpdated": "2024-10-15T15:45:06.397Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Log in or create an account to share your comment.

Tags

Taxonomy of the tags.

All sightings related to this event Export sightings related to this event

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.