CVE-2024-47944

MediumCVSS 6.8/10Last modified Jun 17, 2026

Description

The device directly executes .patch firmware upgrade files on a USB stick without any prior authentication in the admin interface. This leads to an unauthenticated code execution via the firmware upgrade function.

Metrics

CVSS 3.1 6.8/10CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-1299

Affected software

Vendor	Product	Versions
RITTAL GmbH & Co. KG	IoT Interface & CMC III Processing Unit	<6.21.00.2
rittal_gmbh_and_co.kg	iot_interface_and_cmc_iii_processing_unit	< 6.21.00.2

References

Timeline

Published: Oct 15, 2024
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2024

CVE-2024-479459.8The devices are vulnerable to session hijacking due to insufficient entropy in its session ID generation algorithm. The session IDs are pr CVE-2024-479467.2If the attacker has access to a valid Poweruser session, remote code execution is possible because specially crafted valid PNG files with in CVE-2024-479474.7Due to missing input sanitization, an attacker can perform cross-site-scripting attacks and run arbitrary Javascript in the browser of other CVE-2024-479487.5In JetBrains TeamCity before 2024.07.3 path traversal leading to information disclosure was possible via server backups CVE-2024-479497.5In JetBrains TeamCity before 2024.07.3 path traversal allowed backup file write to arbitrary location CVE-2024-47958.8A vulnerability was found in Campcodes Online Laundry Management System 1.0 and classified as critical. Affected by this issue is some unkno CVE-2024-479505.4In JetBrains TeamCity before 2024.07.3 stored XSS was possible in Backup configuration settings CVE-2024-479515.4In JetBrains TeamCity before 2024.07.3 stored XSS was possible via server global settings CVE-2024-47968.8A vulnerability was found in Campcodes Online Laundry Management System 1.0. It has been classified as critical. This affects an unknown par CVE-2024-479627.8Delta Electronics CNCSoft-G2 lacks proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based b CVE-2024-479637.8Delta Electronics CNCSoft-G2 lacks proper validation of user-supplied data, which can result in a write past the end of an allocated object.CVE-2024-479647.8Delta Electronics CNCSoft-G2 lacks proper validation of the length of user-supplied data prior to copying it to a fixed-length heap-based bu