CVE-2024-47943

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2024-47943", "assignerOrgId": "551230f0-3615-47bd-b7cc-93e92e730bbf", "state": "PUBLISHED", "assignerShortName": "SEC-VLab", "dateReserved": "2024-10-07T13:39:52.543Z", "datePublished": "2024-10-15T08:57:05.068Z", "dateUpdated": "2025-11-03T22:21:53.100Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "affected", "product": "IoT Interface & CMC III Processing Unit", "vendor": "RITTAL GmbH & Co. KG", "versions": [{"status": "affected", "version": "<6.21.00.2", "versionType": "custom"}]}], "credits": [{"lang": "en", "type": "finder", "value": "Johannes Kruchem, SEC Consult Vulnerability Lab"}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p>The firmware upgrade function in the admin web interface of the Rittal&nbsp;IoT Interface &amp; CMC III Processing Unit devices checks if \nthe patch files are signed before executing the containing run.sh \nscript. The signing process is kind of an HMAC with a long string as key\n which is hard-coded in the firmware and is freely available for \ndownload. This allows crafting malicious \"signed\" .patch files in order \nto compromise the device and execute arbitrary code.</p><p></p>"}], "value": "The firmware upgrade function in the admin web interface of the Rittal\u00a0IoT Interface & CMC III Processing Unit devices checks if \nthe patch files are signed before executing the containing run.sh \nscript. The signing process is kind of an HMAC with a long string as key\n which is hard-coded in the firmware and is freely available for \ndownload. This allows crafting malicious \"signed\" .patch files in order \nto compromise the device and execute arbitrary code."}], "exploits": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "SEC Consult has published proof of concept code for this vulnerability."}], "value": "SEC Consult has published proof of concept code for this vulnerability."}], "impacts": [{"capecId": "CAPEC-186", "descriptions": [{"lang": "en", "value": "CAPEC-186 Malicious Software Update"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-347", "description": "CWE-347 Improper Verification of Cryptographic Signature", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "551230f0-3615-47bd-b7cc-93e92e730bbf", "shortName": "SEC-VLab", "dateUpdated": "2024-10-15T08:57:05.068Z"}, "references": [{"tags": ["third-party-advisory"], "url": "https://r.sec-consult.com/rittaliot"}, {"tags": ["patch"], "url": "https://www.rittal.com/de-de/products/deep/3124300"}], "solutions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p>The vendor provides a patched version V6.21.00.2 which can be downloaded from the following URL:&nbsp;<a target=\"_blank\" rel=\"nofollow\" href=\"https://www.rittal.com/de-de/products/deep/3124300\">www.rittal.com/de-de/products/deep/3124300</a></p><br>"}], "value": "The vendor provides a patched version V6.21.00.2 which can be downloaded from the following URL:\u00a0 www.rittal.com/de-de/products/deep/3124300 https://www.rittal.com/de-de/products/deep/3124300"}], "source": {"discovery": "UNKNOWN"}, "title": "Improper signature verification of firmware upgrade files", "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2024-10-15T13:25:02.130829Z", "id": "CVE-2024-47943", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-03-17T15:21:48.883Z"}}, {"title": "CVE Program Container", "references": [{"url": "http://seclists.org/fulldisclosure/2024/Oct/4"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2025-11-03T22:21:53.100Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "http://seclists.org/fulldisclosure/2024/Oct/4"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2025-11-03T22:21:53.100Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2024-47943", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2024-10-15T13:25:02.130829Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-10-15T13:26:41.421Z"}}], "cna": {"title": "Improper signature verification of firmware upgrade files", "source": {"discovery": "UNKNOWN"}, "credits": [{"lang": "en", "type": "finder", "value": "Johannes Kruchem, SEC Consult Vulnerability Lab"}], "impacts": [{"capecId": "CAPEC-186", "descriptions": [{"lang": "en", "value": "CAPEC-186 Malicious Software Update"}]}], "affected": [{"vendor": "RITTAL GmbH & Co. KG", "product": "IoT Interface & CMC III Processing Unit", "versions": [{"status": "affected", "version": "<6.21.00.2", "versionType": "custom"}], "defaultStatus": "affected"}], "exploits": [{"lang": "en", "value": "SEC Consult has published proof of concept code for this vulnerability.", "supportingMedia": [{"type": "text/html", "value": "SEC Consult has published proof of concept code for this vulnerability.", "base64": false}]}], "solutions": [{"lang": "en", "value": "The vendor provides a patched version V6.21.00.2 which can be downloaded from the following URL:\u00a0 www.rittal.com/de-de/products/deep/3124300 https://www.rittal.com/de-de/products/deep/3124300", "supportingMedia": [{"type": "text/html", "value": "<p>The vendor provides a patched version V6.21.00.2 which can be downloaded from the following URL:&nbsp;<a target=\"_blank\" rel=\"nofollow\" href=\"https://www.rittal.com/de-de/products/deep/3124300\">www.rittal.com/de-de/products/deep/3124300</a></p><br>", "base64": false}]}], "references": [{"url": "https://r.sec-consult.com/rittaliot", "tags": ["third-party-advisory"]}, {"url": "https://www.rittal.com/de-de/products/deep/3124300", "tags": ["patch"]}], "x_generator": {"engine": "Vulnogram 0.2.0"}, "descriptions": [{"lang": "en", "value": "The firmware upgrade function in the admin web interface of the Rittal\u00a0IoT Interface & CMC III Processing Unit devices checks if \nthe patch files are signed before executing the containing run.sh \nscript. The signing process is kind of an HMAC with a long string as key\n which is hard-coded in the firmware and is freely available for \ndownload. This allows crafting malicious \"signed\" .patch files in order \nto compromise the device and execute arbitrary code.", "supportingMedia": [{"type": "text/html", "value": "<p>The firmware upgrade function in the admin web interface of the Rittal&nbsp;IoT Interface &amp; CMC III Processing Unit devices checks if \nthe patch files are signed before executing the containing run.sh \nscript. The signing process is kind of an HMAC with a long string as key\n which is hard-coded in the firmware and is freely available for \ndownload. This allows crafting malicious \"signed\" .patch files in order \nto compromise the device and execute arbitrary code.</p><p></p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-347", "description": "CWE-347 Improper Verification of Cryptographic Signature"}]}], "providerMetadata": {"orgId": "551230f0-3615-47bd-b7cc-93e92e730bbf", "shortName": "SEC-VLab", "dateUpdated": "2024-10-15T08:57:05.068Z"}}}, "cveMetadata": {"cveId": "CVE-2024-47943", "state": "PUBLISHED", "dateUpdated": "2025-11-03T22:21:53.100Z", "dateReserved": "2024-10-07T13:39:52.543Z", "assignerOrgId": "551230f0-3615-47bd-b7cc-93e92e730bbf", "datePublished": "2024-10-15T08:57:05.068Z", "assignerShortName": "SEC-VLab"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "affected", "product": "IoT Interface & CMC III Processing Unit", "vendor": "RITTAL GmbH & Co. KG", "versions": [{"status": "affected", "version": "<6.21.00.2", "versionType": "custom"}]}], "source": "551230f0-3615-47bd-b7cc-93e92e730bbf"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The firmware upgrade function in the admin web interface of the Rittal\u00a0IoT Interface & CMC III Processing Unit devices checks if \nthe patch files are signed before executing the containing run.sh \nscript. The signing process is kind of an HMAC with a long string as key\n which is hard-coded in the firmware and is freely available for \ndownload. This allows crafting malicious \"signed\" .patch files in order \nto compromise the device and execute arbitrary code."}, {"lang": "es", "value": "La funci\u00f3n de actualizaci\u00f3n de firmware en la interfaz web de administraci\u00f3n de los dispositivos Rittal IoT Interface &amp; CMC III Processing Unit comprueba si los archivos de parche est\u00e1n firmados antes de ejecutar el script run.sh que los contiene. El proceso de firma es una especie de HMAC con una cadena larga como clave que est\u00e1 codificada en el firmware y est\u00e1 disponible de forma gratuita para su descarga. Esto permite manipular archivos .patch \"firmados\" maliciosos para comprometer el dispositivo y ejecutar c\u00f3digo arbitrario."}], "id": "CVE-2024-47943", "lastModified": "2026-06-17T07:58:02.427", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2024-47943", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2024-10-15T13:25:02.130829Z", "version": "2.0.3"}}]}, "published": "2024-10-15T09:15:03.357", "references": [{"source": "551230f0-3615-47bd-b7cc-93e92e730bbf", "url": "https://r.sec-consult.com/rittaliot"}, {"source": "551230f0-3615-47bd-b7cc-93e92e730bbf", "url": "https://www.rittal.com/de-de/products/deep/3124300"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://seclists.org/fulldisclosure/2024/Oct/4"}], "sourceIdentifier": "551230f0-3615-47bd-b7cc-93e92e730bbf", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-347"}], "source": "551230f0-3615-47bd-b7cc-93e92e730bbf", "type": "Secondary"}]}

{}

{}