Security Advisory

CVE-2024-47943

CVE vulnerability detail — eXtreme Datacenter Security Operations

Published 2024-10-15 08:57:05

Last updated 2025-11-03 22:21:53

Assigner SEC-VLab

State PUBLISHED

Description

The firmware upgrade function in the admin web interface of the Rittal IoT Interface & CMC III Processing Unit devices checks if the patch files are signed before executing the containing run.sh script. The signing process is kind of an HMAC with a long string as key which is hard-coded in the firmware and is freely available for download. This allows crafting malicious "signed" .patch files in order to compromise the device and execute arbitrary code.

← Browse all CVEs View on cve.org ↗