CVE-2024-47944

Published: Oct 15, 2024Modified: Jun 17, 2026Deferred

6.8

Vector

CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability: 0.9 / Impact: 5.9

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary)

Description

The device directly executes .patch firmware upgrade files on a USB stick without any prior authentication in the admin interface. This leads to an unauthenticated code execution via the firmware upgrade function.

Related CWEs

CWE-1299

Missing Protection Mechanism for Alternate Hardware Interface

The lack of protections on alternate paths to access control-protected assets (such as unprotected shadow registers and other external facing unguarded interfaces) allows an attacker to bypass existing protections to the asset that are only performed against the primary path.

References (3)

https://r.sec-consult.com/rittaliot

Source: 551230f0-3615-47bd-b7cc-93e92e730bbf

https://www.rittal.com/de-de/products/deep/3124300

Source: 551230f0-3615-47bd-b7cc-93e92e730bbf

http://seclists.org/fulldisclosure/2024/Oct/4

Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.