Lucene search
K
Database
Vendors
Products
Years
CVSS
Scanner
Agent Scanning
API Scanning
Manual Audit
Perimeter Scanner
Scanning
Projects
Email
Webhook
Plugins
Resources
Documents
Blog
Glossary
FAQ
Pricing
Contacts
About Us
Partners
Branding Guideline
cve[email protected]CVE-2022-24796
HistoryMar 31, 2022 - 11:15 p.m.

CVE-2022-24796

2022-03-3123:15:08
CWE-78
[email protected]
web.nvd.nist.gov
80
raspberrymatic
rce
remote code execution
vulnerability
iot
smart home
operating system
update
security advisory

10 High

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:N/C:C/I:C/A:C

10 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

10 High

AI Score

Confidence

High

0.005 Low

EPSS

Percentile

76.3%

JSON

RaspberryMatic is a free and open-source operating system for running a cloud-free smart-home using the homematicIP / HomeMatic hardware line of IoT devices. A Remote Code Execution (RCE) vulnerability in the file upload facility of the WebUI interface of RaspberryMatic exists. Missing input validation/sanitization in the file upload mechanism allows remote, unauthenticated attackers with network access to the WebUI interface to achieve arbitrary operating system command execution via shell metacharacters in the HTTP query string. Injected commands are executed as root, thus leading to a full compromise of the underlying system and all its components. Versions after 2.31.25.20180428 and prior to 3.63.8.20220330 are affected. Users are advised to update to version 3.63.8.20220330 or newer. There are currently no known workarounds to mitigate the security impact and users are advised to update to the latest version available.

Affected configurations

Vulners
NVD
Node
jens-mausraspberrymaticRange2.31.25.20180428–3.63.8.20220330

CNA Affected

[
  {
    "product": "RaspberryMatic",
    "vendor": "jens-maus",
    "versions": [
      {
        "status": "affected",
        "version": ">= 2.31.25.20180428, < 3.63.8.20220330"
      }
    ]
  }
]

Related

cvelist 1
prion 1
nvd 1
cvelist
cvelist
CVE-2022-24796 Remote Command Injection in RaspberryMatic
2022-03-31 22:40:17
prion
prion
Design/Logic Flaw
2022-03-31 23:15:00
nvd
nvd
CVE-2022-24796
2022-03-31 23:15:08

10 High

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:N/C:C/I:C/A:C

10 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

10 High

AI Score

Confidence

High

0.005 Low

EPSS

Percentile

76.3%

JSON
Related for CVE-2022-24796
cvelist1prion1nvd1