Vulnerability Description
RaspberryMatic is an open-source operating system for HomeMatic internet-of-things devices. RaspberryMatic / OCCU prior to version 3.75.6.20240316 contains a unauthenticated remote code execution (RCE) vulnerability, caused by multiple issues within the Java based `HMIPServer.jar` component. RaspberryMatric includes a Java based `HMIPServer`, that can be accessed through URLs starting with `/pages/jpages`. The `FirmwareController` class does however not perform any session id checks, thus this feature can be accessed without a valid session. Due to this issue, attackers can gain remote code execution as root user, allowing a full system compromise. Version 3.75.6.20240316 contains a patch.
CVSS Score
CRITICAL
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Raspberrymatic | Raspberrymatic | < 3.75.6.20240316 |
Related Weaknesses (CWE)
References
- https://github.com/jens-maus/RaspberryMatic/security/advisories/GHSA-q967-q4j8-6Vendor AdvisoryExploit
- https://github.com/jens-maus/RaspberryMatic/security/advisories/GHSA-q967-q4j8-6Vendor AdvisoryExploit
FAQ
What is CVE-2024-24578?
CVE-2024-24578 is a vulnerability with a CVSS score of 10.0 (CRITICAL). RaspberryMatic is an open-source operating system for HomeMatic internet-of-things devices. RaspberryMatic / OCCU prior to version 3.75.6.20240316 contains a unauthenticated remote code execution (RCE...
How severe is CVE-2024-24578?
CVE-2024-24578 has been rated CRITICAL with a CVSS base score of 10.0/10. This is considered a critical vulnerability requiring immediate attention.
Is there a patch for CVE-2024-24578?
Check the references section above for vendor advisories and patch information. Affected products include: Raspberrymatic Raspberrymatic.