« Volver al listado

CVE-2024-47944

Estado: AplazadaMedia (6.8)—

The device directly executes .patch firmware upgrade files on a USB stick without any prior authentication in the admin interface. This leads to an unauthenticated code execution via the firmware upgrade function.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2024-47944",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2024-47944",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2024-10-15T15:43:38.181689Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 6.8,
          "attackVector": "PHYSICAL",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 0.9
      }
    ]
  },
  "affected": [
    {
      "source": "551230f0-3615-47bd-b7cc-93e92e730bbf",
      "affectedData": [
        {
          "vendor": "RITTAL GmbH & Co. KG",
          "product": "IoT Interface & CMC III Processing Unit",
          "versions": [
            {
              "status": "affected",
              "version": "<6.21.00.2",
              "versionType": "custom"
            }
          ],
          "defaultStatus": "affected"
        }
      ]
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "affectedData": [
        {
          "cpes": [
            "cpe:2.3:a:rittal_gmbh_and_co.kg:iot_interface_and_cmc_iii_processing_unit:*:*:*:*:*:*:*:*"
          ],
          "vendor": "rittal_gmbh_and_co.kg",
          "product": "iot_interface_and_cmc_iii_processing_unit",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "lessThan": "6.21.00.2",
              "versionType": "custom"
            }
          ],
          "defaultStatus": "unknown"
        }
      ]
    }
  ],
  "published": "2024-10-15T09:15:03.580",
  "references": [
    {
      "url": "https://r.sec-consult.com/rittaliot",
      "source": "551230f0-3615-47bd-b7cc-93e92e730bbf"
    },
    {
      "url": "https://www.rittal.com/de-de/products/deep/3124300",
      "source": "551230f0-3615-47bd-b7cc-93e92e730bbf"
    },
    {
      "url": "http://seclists.org/fulldisclosure/2024/Oct/4",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "551230f0-3615-47bd-b7cc-93e92e730bbf",
      "description": [
        {
          "lang": "en",
          "value": "CWE-1299"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "The device directly executes .patch firmware upgrade files on a USB stick without any prior authentication in the admin interface. This leads to an unauthenticated code execution via the firmware upgrade function."
    },
    {
      "lang": "es",
      "value": "El dispositivo ejecuta directamente los archivos de actualización de firmware .patch en una memoria USB sin ninguna autenticación previa en la interfaz de administración. Esto da lugar a una ejecución de código no autenticado a través de la función de actualización de firmware."
    }
  ],
  "lastModified": "2026-06-17T07:58:02.560",
  "sourceIdentifier": "551230f0-3615-47bd-b7cc-93e92e730bbf"
}