{"id":"CVE-2024-47943","aliases":["EUVD-2024-42735","GHSA-3ggr-5p57-2xgh"],"status":"published","title":"Improper signature verification of firmware upgrade files","description":"The firmware upgrade function in the admin web interface of the Rittal IoT Interface \u0026 CMC III Processing Unit devices checks if \nthe patch files are signed before executing the containing run.sh \nscript. The signing process is kind of an HMAC with a long string as key\n which is hard-coded in the firmware and is freely available for \ndownload. This allows crafting malicious \"signed\" .patch files in order \nto compromise the device and execute arbitrary code.","severity":{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-11","score":0.00636,"percentile":0.50923,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-347"],"published":"2024-10-15T08:57:05Z","modified":"2026-06-17T07:58:02Z","products":[{"vendor":"rittal gmbh \u0026 co. kg","product":"iot interface \u0026 cmc iii processing unit"}],"references":[{"url":"https://r.sec-consult.com/rittaliot","tags":["third-party-advisory"]},{"url":"https://www.rittal.com/de-de/products/deep/3124300","tags":["patch"]},{"url":"http://seclists.org/fulldisclosure/2024/Oct/4"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-47943"},{"url":"https://github.com/advisories/GHSA-3ggr-5p57-2xgh"}],"sources":{"cve":[{"id":"CVE-2024-47943","title":"Improper signature verification of firmware upgrade files","description":"The firmware upgrade function in the admin web interface of the Rittal IoT Interface \u0026 CMC III Processing Unit devices checks if \nthe patch files are signed before executing the containing run.sh \nscript. The signing process is kind of an HMAC with a long string as key\n which is hard-coded in the firmware and is freely available for \ndownload. This allows crafting malicious \"signed\" .patch files in order \nto compromise the device and execute arbitrary code.","status":"published","published":"2024-10-15T08:57:05.068Z","modified":"2025-11-03T22:21:53.1Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"adp"}],"cwes":["CWE-347"],"updated_at":"2026-11-02T14:33:57.302325Z"}],"euvd":[{"id":"EUVD-2024-42735","description":"The firmware upgrade function in the admin web interface of the Rittal IoT Interface \u0026 CMC III Processing Unit devices checks if \nthe patch files are signed before executing the containing run.sh \nscript. The signing process is kind of an HMAC with a long string as key\n which is hard-coded in the firmware and is freely available for \ndownload. This allows crafting malicious \"signed\" .patch files in order \nto compromise the device and execute arbitrary code.","status":"published","published":"2024-10-15T08:57:05Z","modified":"2025-11-03T22:21:53Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T19:49:29.890052Z"}],"ghsa":[{"id":"GHSA-3ggr-5p57-2xgh","title":"The firmware upgrade function in the admin web interface of the Rittal IoT Interface \u0026 CMC III...","description":"The firmware upgrade function in the admin web interface of the Rittal IoT Interface \u0026 CMC III Processing Unit devices checks if \nthe patch files are signed before executing the containing run.sh \nscript. The signing process is kind of an HMAC with a long string as key\n which is hard-coded in the firmware and is freely available for \ndownload. This allows crafting malicious \"signed\" .patch files in order \nto compromise the device and execute arbitrary code.","status":"published","published":"2024-10-15T09:30:31Z","modified":"2025-11-04T00:31:34Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-347"],"updated_at":"2026-11-02T15:04:28.99549Z"}],"nvd":[{"id":"CVE-2024-47943","description":"The firmware upgrade function in the admin web interface of the Rittal IoT Interface \u0026 CMC III Processing Unit devices checks if \nthe patch files are signed before executing the containing run.sh \nscript. The signing process is kind of an HMAC with a long string as key\n which is hard-coded in the firmware and is freely available for \ndownload. This allows crafting malicious \"signed\" .patch files in order \nto compromise the device and execute arbitrary code.","status":"published","published":"2024-10-15T09:15:03.357Z","modified":"2026-06-17T07:58:02.427Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"secondary"}],"cwes":["CWE-347"],"updated_at":"2026-11-02T14:10:31.879321Z"}]}}