CVE-2024-47945: Predictable Session ID

Severity: critical (CVSS 9.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.9% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2024-10-15 · updated 2026-06-17
Weakness: CWE-340

Description

The devices are vulnerable to session hijacking due to insufficient entropy in its session ID generation algorithm. The session IDs are predictable, with only 32,768 possible values per user, which allows attackers to pre-generate valid session IDs, leading to unauthorized access to user sessions. This is not only due to the use of an (insecure) rand() function call but also because of missing initialization via srand(). As a result only the PIDs are effectively used as seed.

Affected products

Rittal Cmc Iii Processing Units Firmware: before 6.21.00.2 — fixed in 6.21.00.2
Rittal Iot Interface Firmware: before 6.21.00.2 — fixed in 6.21.00.2

How to fix

Upgrade to a fixed version: Rittal Cmc Iii Processing Units Firmware 6.21.00.2; Rittal Iot Interface Firmware 6.21.00.2. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2024-47945 or the next vulnerability affects your stack