CVE-2024-47943

{"id": "CVE-2024-47943", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}]}, "published": "2024-10-15T09:15:03.357", "references": [{"url": "https://r.sec-consult.com/rittaliot", "source": "551230f0-3615-47bd-b7cc-93e92e730bbf"}, {"url": "https://www.rittal.com/de-de/products/deep/3124300", "source": "551230f0-3615-47bd-b7cc-93e92e730bbf"}, {"url": "http://seclists.org/fulldisclosure/2024/Oct/4", "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Secondary", "source": "551230f0-3615-47bd-b7cc-93e92e730bbf", "description": [{"lang": "en", "value": "CWE-347"}]}], "descriptions": [{"lang": "en", "value": "The firmware upgrade function in the admin web interface of the Rittal\u00a0IoT Interface & CMC III Processing Unit devices checks if \nthe patch files are signed before executing the containing run.sh \nscript. The signing process is kind of an HMAC with a long string as key\n which is hard-coded in the firmware and is freely available for \ndownload. This allows crafting malicious \"signed\" .patch files in order \nto compromise the device and execute arbitrary code."}, {"lang": "es", "value": "La funci\u00f3n de actualizaci\u00f3n de firmware en la interfaz web de administraci\u00f3n de los dispositivos Rittal IoT Interface & CMC III Processing Unit comprueba si los archivos de parche est\u00e1n firmados antes de ejecutar el script run.sh que los contiene. El proceso de firma es una especie de HMAC con una cadena larga como clave que est\u00e1 codificada en el firmware y est\u00e1 disponible de forma gratuita para su descarga. Esto permite manipular archivos .patch \"firmados\" maliciosos para comprometer el dispositivo y ejecutar c\u00f3digo arbitrario."}], "lastModified": "2025-11-03T23:16:23.247", "sourceIdentifier": "551230f0-3615-47bd-b7cc-93e92e730bbf"}