CVE-2024-24578
CVSS 3.1 Score 10.0 of 10 (high)
Details
Summary
CVE-2024-24578 is a critical vulnerability affecting RaspberryMatic, an open-source operating system for HomeMatic internet-of-things devices. Versions prior to 3.75.6.20240316 are vulnerable to unauthenticated remote code execution (RCE) due to multiple issues in the Java-based `HMIPServer.jar` component. Attackers can exploit this vulnerability by accessing the `HMIPServer` through URLs starting with `/pages/jpages` without a valid session. This allows them to execute code as the root user and gain complete control over the system. The issue has been patched in version 3.75.6.20240316, and organizations are advised to update their RaspberryMatic installations to mitigate the risk of a full system compromise.
Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.
Advisories, Assessments, and Mitigations
Prioritize, Pinpoint, and Act to Prevent Vulnerability Exploits with Recorded Future
- Gain complete coverage of your cyber, third party, and physical attack surface
- Proactively mitigate threats before they turn into costly attacks
- Make fast, effective, data-driven decisions