CVE-2024-47943

Improper signature verification of firmware upgrade files

State: Published
Severity: 9.8 Critical
Published: Oct 15, 2024
Updated: Nov 3, 2025
Reserved: Oct 7, 2024

Description

The firmware upgrade function in the admin web interface of the Rittal IoT Interface & CMC III Processing Unit devices checks if the patch files are signed before executing the containing run.sh script. The signing process is kind of an HMAC with a long string as key which is hard-coded in the firmware and is freely available for download. This allows crafting malicious "signed" .patch files in order to compromise the device and execute arbitrary code.

Scores

CVSS	Score	Vector	Source
3.1	9.8 Critical	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	CISA-ADP

Weaknesses

CWE-347 Improper Verification of Cryptographic Signature

Affected Products

Product	Versions
IoT Interface & CMC III Processing UnitRITTAL GmbH & Co. KG	<6.21.00.2Affected

References

https://r.sec-consult.com/rittaliotthird-party-advisory
https://www.rittal.com/de-de/products/deep/3124300patch
http://seclists.org/fulldisclosure/2024/Oct/4

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.