CVE-2024-47944: Missing Protection Mechanism for Alternate Hardware Interface

Severity: medium (CVSS 6.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2024-10-15 · updated 2026-06-17
Weakness: CWE-1299

Description

The device directly executes .patch firmware upgrade files on a USB stick without any prior authentication in the admin interface. This leads to an unauthenticated code execution via the firmware upgrade function.

Affected products

Rittal Gmbh And Co.Kg Iot Interface And Cmc Iii Processing Unit: before 6.21.00.2 — fixed in 6.21.00.2

How to fix

Upgrade to a fixed version: Rittal Gmbh And Co.Kg Iot Interface And Cmc Iii Processing Unit 6.21.00.2. Check the vendor advisory for mitigations.

References

https://r.sec-consult.com/rittaliot
https://www.rittal.com/de-de/products/deep/3124300
http://seclists.org/fulldisclosure/2024/Oct/4

Get alerted when CVE-2024-47944 or the next vulnerability affects your stack