9.8

CVE-2024-47945

Exploit
The devices are vulnerable to session hijacking due to insufficient 
entropy in its session ID generation algorithm. The session IDs are 
predictable, with only 32,768 possible values per user, which allows 
attackers to pre-generate valid session IDs, leading to unauthorized 
access to user sessions. This is not only due to the use of an 
(insecure) rand() function call but also because of missing 
initialization via srand(). As a result only the PIDs are effectively 
used as seed.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Rittal ≫ Iot Interface Firmware Version < 6.21.00.2
   Rittal ≫ Iot Interface Version-
Rittal ≫ Cmc Iii Processing Units Firmware Version < 6.21.00.2
   Rittal ≫ Cmc Iii Processing Units Version-
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.3% 0.532
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 9.8 3.9 5.9
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
134c704f-9b21-4f2e-91b3-4a467353bcc0 9.1 3.9 5.2
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
CWE-331 Insufficient Entropy

The product uses an algorithm or scheme that produces insufficient entropy, leaving patterns or clusters of values that are more likely to occur than others.

CWE-340 Generation of Predictable Numbers or Identifiers

The product uses a scheme that generates numbers or identifiers that are more predictable than required.

https://r.sec-consult.com/rittaliot
Third Party Advisory
Exploit