Description
The device directly executes .patch firmware upgrade files on a USB stick without any prior authentication in the admin interface. This leads to an unauthenticated code execution via the firmware upgrade function.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| RITTAL GmbH & Co. KG | IoT Interface & CMC III Processing Unit | <6.21.00.2 | — |
References
- https://r.sec-consult.com/rittaliot third-party-advisory
- https://www.rittal.com/de-de/products/deep/3124300 patch