CVE-2024-47944

Description

The device directly executes .patch firmware upgrade files on a USB stick without any prior authentication in the admin interface. This leads to an unauthenticated code execution via the firmware upgrade function.

Reserved 2024-10-07 | Published 2024-10-15 | Updated 2024-10-15 | Assigner SEC-VLab

Problem types

CWE-1299: Missing Protection Mechanism for Alternate Hardware Interface

Product status

Default status
affected

<6.21.00.2
affected

Credits

Johannes Kruchem, SEC Consult Vulnerability Lab finder

References

r.sec-consult.com/rittaliot third-party-advisory

www.rittal.com/de-de/products/deep/3124300 patch

cve.org (CVE-2024-47944)

nvd.nist.gov (CVE-2024-47944)

Download JSON