CVE-2024-47943 (GCVE-0-2024-47943)

Vulnerability from cvelistv5 – Published: 2024-10-15 08:57 – Updated: 2025-11-03 22:21
VLAI?
Title
Improper signature verification of firmware upgrade files
Summary
The firmware upgrade function in the admin web interface of the Rittal IoT Interface & CMC III Processing Unit devices checks if the patch files are signed before executing the containing run.sh script. The signing process is kind of an HMAC with a long string as key which is hard-coded in the firmware and is freely available for download. This allows crafting malicious "signed" .patch files in order to compromise the device and execute arbitrary code.
Severity ?
9.8 (Critical)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CWE
  • CWE-347 - Improper Verification of Cryptographic Signature
Assigner
References
Impacted products
Vendor Product Version
RITTAL GmbH & Co. KG IoT Interface & CMC III Processing Unit Affected: <6.21.00.2 (custom)
Create a notification for this product.
Credits
Johannes Kruchem, SEC Consult Vulnerability Lab
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 9.8,
              "baseSeverity": "CRITICAL",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2024-47943",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-10-15T13:25:02.130829Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-03-17T15:21:48.883Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T22:21:53.100Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "http://seclists.org/fulldisclosure/2024/Oct/4"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "affected",
          "product": "IoT Interface \u0026 CMC III Processing Unit",
          "vendor": "RITTAL GmbH \u0026 Co. KG",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c6.21.00.2",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Johannes Kruchem, SEC Consult Vulnerability Lab"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eThe firmware upgrade function in the admin web interface of the Rittal\u0026nbsp;IoT Interface \u0026amp; CMC III Processing Unit devices checks if \nthe patch files are signed before executing the containing run.sh \nscript. The signing process is kind of an HMAC with a long string as key\n which is hard-coded in the firmware and is freely available for \ndownload. This allows crafting malicious \"signed\" .patch files in order \nto compromise the device and execute arbitrary code.\u003c/p\u003e\u003cp\u003e\u003c/p\u003e"
            }
          ],
          "value": "The firmware upgrade function in the admin web interface of the Rittal\u00a0IoT Interface \u0026 CMC III Processing Unit devices checks if \nthe patch files are signed before executing the containing run.sh \nscript. The signing process is kind of an HMAC with a long string as key\n which is hard-coded in the firmware and is freely available for \ndownload. This allows crafting malicious \"signed\" .patch files in order \nto compromise the device and execute arbitrary code."
        }
      ],
      "exploits": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "SEC Consult has published proof of concept code for this vulnerability."
            }
          ],
          "value": "SEC Consult has published proof of concept code for this vulnerability."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-186",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-186 Malicious Software Update"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-347",
              "description": "CWE-347 Improper Verification of Cryptographic Signature",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-10-15T08:57:05.068Z",
        "orgId": "551230f0-3615-47bd-b7cc-93e92e730bbf",
        "shortName": "SEC-VLab"
      },
      "references": [
        {
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://r.sec-consult.com/rittaliot"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://www.rittal.com/de-de/products/deep/3124300"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eThe vendor provides a patched version V6.21.00.2 which can be downloaded from the following URL:\u0026nbsp;\u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://www.rittal.com/de-de/products/deep/3124300\"\u003ewww.rittal.com/de-de/products/deep/3124300\u003c/a\u003e\u003c/p\u003e\u003cbr\u003e"
            }
          ],
          "value": "The vendor provides a patched version V6.21.00.2 which can be downloaded from the following URL:\u00a0 www.rittal.com/de-de/products/deep/3124300 https://www.rittal.com/de-de/products/deep/3124300"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Improper signature verification of firmware upgrade files",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "551230f0-3615-47bd-b7cc-93e92e730bbf",
    "assignerShortName": "SEC-VLab",
    "cveId": "CVE-2024-47943",
    "datePublished": "2024-10-15T08:57:05.068Z",
    "dateReserved": "2024-10-07T13:39:52.543Z",
    "dateUpdated": "2025-11-03T22:21:53.100Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "fkie_nvd": {
      "descriptions": "[{\"lang\": \"en\", \"value\": \"The firmware upgrade function in the admin web interface of the Rittal\\u00a0IoT Interface \u0026 CMC III Processing Unit devices checks if \\nthe patch files are signed before executing the containing run.sh \\nscript. The signing process is kind of an HMAC with a long string as key\\n which is hard-coded in the firmware and is freely available for \\ndownload. This allows crafting malicious \\\"signed\\\" .patch files in order \\nto compromise the device and execute arbitrary code.\"}, {\"lang\": \"es\", \"value\": \"La funci\\u00f3n de actualizaci\\u00f3n de firmware en la interfaz web de administraci\\u00f3n de los dispositivos Rittal IoT Interface \u0026amp; CMC III Processing Unit comprueba si los archivos de parche est\\u00e1n firmados antes de ejecutar el script run.sh que los contiene. El proceso de firma es una especie de HMAC con una cadena larga como clave que est\\u00e1 codificada en el firmware y est\\u00e1 disponible de forma gratuita para su descarga. Esto permite manipular archivos .patch \\\"firmados\\\" maliciosos para comprometer el dispositivo y ejecutar c\\u00f3digo arbitrario.\"}]",
      "id": "CVE-2024-47943",
      "lastModified": "2024-10-15T12:57:46.880",
      "published": "2024-10-15T09:15:03.357",
      "references": "[{\"url\": \"https://r.sec-consult.com/rittaliot\", \"source\": \"551230f0-3615-47bd-b7cc-93e92e730bbf\"}, {\"url\": \"https://www.rittal.com/de-de/products/deep/3124300\", \"source\": \"551230f0-3615-47bd-b7cc-93e92e730bbf\"}]",
      "sourceIdentifier": "551230f0-3615-47bd-b7cc-93e92e730bbf",
      "vulnStatus": "Awaiting Analysis",
      "weaknesses": "[{\"source\": \"551230f0-3615-47bd-b7cc-93e92e730bbf\", \"type\": \"Secondary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-347\"}]}]"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-47943\",\"sourceIdentifier\":\"551230f0-3615-47bd-b7cc-93e92e730bbf\",\"published\":\"2024-10-15T09:15:03.357\",\"lastModified\":\"2025-11-03T23:16:23.247\",\"vulnStatus\":\"Awaiting Analysis\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"The firmware upgrade function in the admin web interface of the Rittal\u00a0IoT Interface \u0026 CMC III Processing Unit devices checks if \\nthe patch files are signed before executing the containing run.sh \\nscript. The signing process is kind of an HMAC with a long string as key\\n which is hard-coded in the firmware and is freely available for \\ndownload. This allows crafting malicious \\\"signed\\\" .patch files in order \\nto compromise the device and execute arbitrary code.\"},{\"lang\":\"es\",\"value\":\"La funci\u00f3n de actualizaci\u00f3n de firmware en la interfaz web de administraci\u00f3n de los dispositivos Rittal IoT Interface \u0026amp; CMC III Processing Unit comprueba si los archivos de parche est\u00e1n firmados antes de ejecutar el script run.sh que los contiene. El proceso de firma es una especie de HMAC con una cadena larga como clave que est\u00e1 codificada en el firmware y est\u00e1 disponible de forma gratuita para su descarga. Esto permite manipular archivos .patch \\\"firmados\\\" maliciosos para comprometer el dispositivo y ejecutar c\u00f3digo arbitrario.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":9.8,\"baseSeverity\":\"CRITICAL\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":5.9}]},\"weaknesses\":[{\"source\":\"551230f0-3615-47bd-b7cc-93e92e730bbf\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-347\"}]}],\"references\":[{\"url\":\"https://r.sec-consult.com/rittaliot\",\"source\":\"551230f0-3615-47bd-b7cc-93e92e730bbf\"},{\"url\":\"https://www.rittal.com/de-de/products/deep/3124300\",\"source\":\"551230f0-3615-47bd-b7cc-93e92e730bbf\"},{\"url\":\"http://seclists.org/fulldisclosure/2024/Oct/4\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"}]}}",
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"http://seclists.org/fulldisclosure/2024/Oct/4\"}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2025-11-03T22:21:53.100Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 9.8, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"CRITICAL\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\", \"integrityImpact\": \"HIGH\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"NONE\", \"confidentialityImpact\": \"HIGH\"}}, {\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-47943\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"poc\"}, {\"Automatable\": \"yes\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-10-15T13:25:02.130829Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-10-15T13:26:41.421Z\"}}], \"cna\": {\"title\": \"Improper signature verification of firmware upgrade files\", \"source\": {\"discovery\": \"UNKNOWN\"}, \"credits\": [{\"lang\": \"en\", \"type\": \"finder\", \"value\": \"Johannes Kruchem, SEC Consult Vulnerability Lab\"}], \"impacts\": [{\"capecId\": \"CAPEC-186\", \"descriptions\": [{\"lang\": \"en\", \"value\": \"CAPEC-186 Malicious Software Update\"}]}], \"affected\": [{\"vendor\": \"RITTAL GmbH \u0026 Co. KG\", \"product\": \"IoT Interface \u0026 CMC III Processing Unit\", \"versions\": [{\"status\": \"affected\", \"version\": \"\u003c6.21.00.2\", \"versionType\": \"custom\"}], \"defaultStatus\": \"affected\"}], \"exploits\": [{\"lang\": \"en\", \"value\": \"SEC Consult has published proof of concept code for this vulnerability.\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"SEC Consult has published proof of concept code for this vulnerability.\", \"base64\": false}]}], \"solutions\": [{\"lang\": \"en\", \"value\": \"The vendor provides a patched version V6.21.00.2 which can be downloaded from the following URL:\\u00a0 www.rittal.com/de-de/products/deep/3124300 https://www.rittal.com/de-de/products/deep/3124300\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"\u003cp\u003eThe vendor provides a patched version V6.21.00.2 which can be downloaded from the following URL:\u0026nbsp;\u003ca target=\\\"_blank\\\" rel=\\\"nofollow\\\" href=\\\"https://www.rittal.com/de-de/products/deep/3124300\\\"\u003ewww.rittal.com/de-de/products/deep/3124300\u003c/a\u003e\u003c/p\u003e\u003cbr\u003e\", \"base64\": false}]}], \"references\": [{\"url\": \"https://r.sec-consult.com/rittaliot\", \"tags\": [\"third-party-advisory\"]}, {\"url\": \"https://www.rittal.com/de-de/products/deep/3124300\", \"tags\": [\"patch\"]}], \"x_generator\": {\"engine\": \"Vulnogram 0.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"The firmware upgrade function in the admin web interface of the Rittal\\u00a0IoT Interface \u0026 CMC III Processing Unit devices checks if \\nthe patch files are signed before executing the containing run.sh \\nscript. The signing process is kind of an HMAC with a long string as key\\n which is hard-coded in the firmware and is freely available for \\ndownload. This allows crafting malicious \\\"signed\\\" .patch files in order \\nto compromise the device and execute arbitrary code.\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"\u003cp\u003eThe firmware upgrade function in the admin web interface of the Rittal\u0026nbsp;IoT Interface \u0026amp; CMC III Processing Unit devices checks if \\nthe patch files are signed before executing the containing run.sh \\nscript. The signing process is kind of an HMAC with a long string as key\\n which is hard-coded in the firmware and is freely available for \\ndownload. This allows crafting malicious \\\"signed\\\" .patch files in order \\nto compromise the device and execute arbitrary code.\u003c/p\u003e\u003cp\u003e\u003c/p\u003e\", \"base64\": false}]}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-347\", \"description\": \"CWE-347 Improper Verification of Cryptographic Signature\"}]}], \"providerMetadata\": {\"orgId\": \"551230f0-3615-47bd-b7cc-93e92e730bbf\", \"shortName\": \"SEC-VLab\", \"dateUpdated\": \"2024-10-15T08:57:05.068Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-47943\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2025-11-03T22:21:53.100Z\", \"dateReserved\": \"2024-10-07T13:39:52.543Z\", \"assignerOrgId\": \"551230f0-3615-47bd-b7cc-93e92e730bbf\", \"datePublished\": \"2024-10-15T08:57:05.068Z\", \"assignerShortName\": \"SEC-VLab\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.