CVE-2024-47945

Katalog CVE

CVSS 9.8 · Critical EPSS 0,87%

Kerentanan Generation of Predictable Numbers or Identifiers pada rittal iot interface firmware, rittal cmc iii processing units firmware. Skor CVSS 3.1 9.8 (Critical) menurut NVD.

Deskripsi (NVD)

The devices are vulnerable to session hijacking due to insufficient entropy in its session ID generation algorithm. The session IDs are predictable, with only 32,768 possible values per user, which allows attackers to pre-generate valid session IDs, leading to unauthorized access to user sessions. This is not only due to the use of an (insecure) rand() function call but also because of missing initialization via srand(). As a result only the PIDs are effectively used as seed.

Rincian

Terbit di NVD

15 Oktober 2024

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

9.8 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-340: Generation of Predictable Numbers or Identifiers
CWE-331: Insufficient Entropy

EPSS (30 hari)

0,87% peluang dieksploitasi; lebih tinggi dari 57,6% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://r.sec-consult.com/rittaliot exploit · advisory pihak ketiga
• https://www.rittal.com/de-de/products/deep/3124300 product
• http://seclists.org/fulldisclosure/2024/Oct/4