CVE-2024-47944
Missing Protection Mechanism for Alternate Hardware Interface
In short
A device allows anyone to upload and run malicious firmware files through a USB stick without requiring a password or login, enabling unauthorized code execution.
Technical detail
The firmware upgrade function in the admin interface lacks authentication mechanisms, allowing unauthenticated attackers to execute arbitrary code by providing crafted .patch files via USB interface. This bypasses the alternate hardware interface protection, resulting in complete system compromise.
Summary generated and translated by AI from the official description.
The device directly executes .patch firmware upgrade files on a USB stick without any prior authentication in the admin interface. This leads to an unauthenticated code execution via the firmware upgrade function.
CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products
RITTAL GmbH & Co. KG · IoT Interface & CMC III Processing UnitWant to know if your infrastructure is exposed to this?
Talk to TrueHacking →