CVE-2024-24578

CVSS V2 None CVSS V3 None
Description
RaspberryMatic is an open-source operating system for HomeMatic internet-of-things devices. RaspberryMatic / OCCU prior to version 3.75.6.20240316 contains a unauthenticated remote code execution (RCE) vulnerability, caused by multiple issues within the Java based `HMIPServer.jar` component. RaspberryMatric includes a Java based `HMIPServer`, that can be accessed through URLs starting with `/pages/jpages`. The `FirmwareController` class does however not perform any session id checks, thus this feature can be accessed without a valid session. Due to this issue, attackers can gain remote code execution as root user, allowing a full system compromise. Version 3.75.6.20240316 contains a patch.
Overview
  • CVE ID
  • CVE-2024-24578
  • Assigner
  • GitHub_M
  • Vulnerability Status
  • PUBLISHED
  • Published Version
  • 2024-03-18T21:13:03.626Z
  • Last Modified Date
  • 2024-03-18T21:13:03.626Z
Weakness Enumerations
CWE URL
CWE-23 http://cwe.mitre.org/data/definitions/23.html
CWE-306 http://cwe.mitre.org/data/definitions/306.html
References
Reference URL Reference Tags
https://github.com/jens-maus/RaspberryMatic/security/advisories/GHSA-q967-q4j8-637h x_refsource_CONFIRM
Sources
Source Name Source URL
NIST https://nvd.nist.gov/vuln/detail/CVE-2024-24578
MITRE https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-24578
History
Created Old Value New Value Data Type Notes
2024-06-26 04:09:41 Added to TrackCVE