{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-47943", "assignerOrgId": "551230f0-3615-47bd-b7cc-93e92e730bbf", "state": "PUBLISHED", "assignerShortName": "SEC-VLab", "dateReserved": "2024-10-07T13:39:52.543Z", "datePublished": "2024-10-15T08:57:05.068Z", "dateUpdated": "2024-10-15T13:27:02.820Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "affected", "product": "IoT Interface & CMC III Processing Unit", "vendor": "RITTAL GmbH & Co. KG", "versions": [{"status": "affected", "version": "<6.21.00.2", "versionType": "custom"}]}], "credits": [{"lang": "en", "type": "finder", "value": "Johannes Kruchem, SEC Consult Vulnerability Lab"}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p>The firmware upgrade function in the admin web interface of the Rittal&nbsp;IoT Interface &amp; CMC III Processing Unit devices checks if \nthe patch files are signed before executing the containing run.sh \nscript. The signing process is kind of an HMAC with a long string as key\n which is hard-coded in the firmware and is freely available for \ndownload. This allows crafting malicious \"signed\" .patch files in order \nto compromise the device and execute arbitrary code.</p><p></p>"}], "value": "The firmware upgrade function in the admin web interface of the Rittal\u00a0IoT Interface & CMC III Processing Unit devices checks if \nthe patch files are signed before executing the containing run.sh \nscript. The signing process is kind of an HMAC with a long string as key\n which is hard-coded in the firmware and is freely available for \ndownload. This allows crafting malicious \"signed\" .patch files in order \nto compromise the device and execute arbitrary code."}], "exploits": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "SEC Consult has published proof of concept code for this vulnerability."}], "value": "SEC Consult has published proof of concept code for this vulnerability."}], "impacts": [{"capecId": "CAPEC-186", "descriptions": [{"lang": "en", "value": "CAPEC-186 Malicious Software Update"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-347", "description": "CWE-347 Improper Verification of Cryptographic Signature", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "551230f0-3615-47bd-b7cc-93e92e730bbf", "shortName": "SEC-VLab", "dateUpdated": "2024-10-15T08:57:05.068Z"}, "references": [{"tags": ["third-party-advisory"], "url": "https://r.sec-consult.com/rittaliot"}, {"tags": ["patch"], "url": "https://www.rittal.com/de-de/products/deep/3124300"}], "solutions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p>The vendor provides a patched version V6.21.00.2 which can be downloaded from the following URL:&nbsp;<a target=\"_blank\" rel=\"nofollow\" href=\"https://www.rittal.com/de-de/products/deep/3124300\">www.rittal.com/de-de/products/deep/3124300</a></p><br>"}], "value": "The vendor provides a patched version V6.21.00.2 which can be downloaded from the following URL:\u00a0 www.rittal.com/de-de/products/deep/3124300 https://www.rittal.com/de-de/products/deep/3124300"}], "source": {"discovery": "UNKNOWN"}, "title": "Improper signature verification of firmware upgrade files", "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2024-10-15T13:25:02.130829Z", "id": "CVE-2024-47943", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-10-15T13:27:02.820Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-47943", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2024-10-15T13:25:02.130829Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-10-15T13:26:41.421Z"}}], "cna": {"title": "Improper signature verification of firmware upgrade files", "source": {"discovery": "UNKNOWN"}, "credits": [{"lang": "en", "type": "finder", "value": "Johannes Kruchem, SEC Consult Vulnerability Lab"}], "impacts": [{"capecId": "CAPEC-186", "descriptions": [{"lang": "en", "value": "CAPEC-186 Malicious Software Update"}]}], "affected": [{"vendor": "RITTAL GmbH & Co. KG", "product": "IoT Interface & CMC III Processing Unit", "versions": [{"status": "affected", "version": "<6.21.00.2", "versionType": "custom"}], "defaultStatus": "affected"}], "exploits": [{"lang": "en", "value": "SEC Consult has published proof of concept code for this vulnerability.", "supportingMedia": [{"type": "text/html", "value": "SEC Consult has published proof of concept code for this vulnerability.", "base64": false}]}], "solutions": [{"lang": "en", "value": "The vendor provides a patched version V6.21.00.2 which can be downloaded from the following URL:\u00a0 www.rittal.com/de-de/products/deep/3124300 https://www.rittal.com/de-de/products/deep/3124300", "supportingMedia": [{"type": "text/html", "value": "<p>The vendor provides a patched version V6.21.00.2 which can be downloaded from the following URL:&nbsp;<a target=\"_blank\" rel=\"nofollow\" href=\"https://www.rittal.com/de-de/products/deep/3124300\">www.rittal.com/de-de/products/deep/3124300</a></p><br>", "base64": false}]}], "references": [{"url": "https://r.sec-consult.com/rittaliot", "tags": ["third-party-advisory"]}, {"url": "https://www.rittal.com/de-de/products/deep/3124300", "tags": ["patch"]}], "x_generator": {"engine": "Vulnogram 0.2.0"}, "descriptions": [{"lang": "en", "value": "The firmware upgrade function in the admin web interface of the Rittal\u00a0IoT Interface & CMC III Processing Unit devices checks if \nthe patch files are signed before executing the containing run.sh \nscript. The signing process is kind of an HMAC with a long string as key\n which is hard-coded in the firmware and is freely available for \ndownload. This allows crafting malicious \"signed\" .patch files in order \nto compromise the device and execute arbitrary code.", "supportingMedia": [{"type": "text/html", "value": "<p>The firmware upgrade function in the admin web interface of the Rittal&nbsp;IoT Interface &amp; CMC III Processing Unit devices checks if \nthe patch files are signed before executing the containing run.sh \nscript. The signing process is kind of an HMAC with a long string as key\n which is hard-coded in the firmware and is freely available for \ndownload. This allows crafting malicious \"signed\" .patch files in order \nto compromise the device and execute arbitrary code.</p><p></p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-347", "description": "CWE-347 Improper Verification of Cryptographic Signature"}]}], "providerMetadata": {"orgId": "551230f0-3615-47bd-b7cc-93e92e730bbf", "shortName": "SEC-VLab", "dateUpdated": "2024-10-15T08:57:05.068Z"}}}, "cveMetadata": {"cveId": "CVE-2024-47943", "state": "PUBLISHED", "dateUpdated": "2024-10-15T13:27:02.820Z", "dateReserved": "2024-10-07T13:39:52.543Z", "assignerOrgId": "551230f0-3615-47bd-b7cc-93e92e730bbf", "datePublished": "2024-10-15T08:57:05.068Z", "assignerShortName": "SEC-VLab"}, "dataVersion": "5.1"}

{"cveTags": [], "descriptions": [{"lang": "en", "value": "The firmware upgrade function in the admin web interface of the Rittal\u00a0IoT Interface & CMC III Processing Unit devices checks if \nthe patch files are signed before executing the containing run.sh \nscript. The signing process is kind of an HMAC with a long string as key\n which is hard-coded in the firmware and is freely available for \ndownload. This allows crafting malicious \"signed\" .patch files in order \nto compromise the device and execute arbitrary code."}], "id": "CVE-2024-47943", "lastModified": "2024-10-15T12:57:46.880", "metrics": {}, "published": "2024-10-15T09:15:03.357", "references": [{"source": "551230f0-3615-47bd-b7cc-93e92e730bbf", "url": "https://r.sec-consult.com/rittaliot"}, {"source": "551230f0-3615-47bd-b7cc-93e92e730bbf", "url": "https://www.rittal.com/de-de/products/deep/3124300"}], "sourceIdentifier": "551230f0-3615-47bd-b7cc-93e92e730bbf", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-347"}], "source": "551230f0-3615-47bd-b7cc-93e92e730bbf", "type": "Secondary"}]}

{}