CVE-2024-47944 — Missing Protection Mechanism for Alternate Hardware Interface

CVE-2024-47944

Missing Protection Mechanism for Alternate Hardware Interface PUBLISHED

Description (CNA)

The device directly executes .patch firmware upgrade files on a USB stick without any prior authentication in the admin interface. This leads to an unauthenticated code execution via the firmware upgrade function.

Affected (CNA)

Vendor / product	Versions
RITTAL GmbH & Co. KG / IoT Interface & CMC III Processing Unit	affected <6.21.00.2

CWE

CWE-1299

References

https://r.sec-consult.com/rittaliot
https://www.rittal.com/de-de/products/deep/3124300

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.

CVE

No English description supplied.

http://seclists.org/fulldisclosure/2024/Oct/4