What’s Vulnerable › Vulnerabilities

CVE-2024-22894

• Severity: medium (CVSS 6.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.7% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2024-01-30 · updated 2026-06-17
• Weakness: CWE-326

Description

An issue fixed in AIT-Deutschland Alpha Innotec Heatpumps V2.88.3 or later, V3.89.0 or later, V4.81.3 or later and Novelan Heatpumps V2.88.3 or later, V3.89.0 or later, V4.81.3 or later, allows remote attackers to execute arbitrary code via the password component in the shadow file.

Affected products

• Alpha-Innotec Heat Pumps Firmware: before 2.88.3; from 3.0.0 before 3.89.0; from 4.0.0 before 4.81.3 — fixed in 2.88.3, 3.89.0, 4.81.3
• Novelan Heat Pumps Firmware: before 2.88.3; from 3.0.0 before 3.89.0; from 4.0.0 before 4.81.3 — fixed in 2.88.3, 3.89.0, 4.81.3

How to fix

Upgrade to a fixed version: Alpha-Innotec Heat Pumps Firmware 2.88.3, 3.89.0, 4.81.3; Novelan Heat Pumps Firmware 2.88.3, 3.89.0, 4.81.3. Check the vendor advisory for mitigations.

References

• https://github.com/Jaarden/AlphaInnotec-Password-Vulnerability/
• https://github.com/Jaarden/CVE-2024-22894
• https://github.com/Jaarden/AlphaInnotec-Password-Vulnerability/
• https://github.com/Jaarden/CVE-2024-22894

Get alerted when CVE-2024-22894 or the next vulnerability affects your stack