CVE-2024-24578

CVE-2024-24578 affects RaspberryMatic / OCCU prior to 3.75.6.20240316. The vulnerability stems from multiple issues in the Java HMIPServer.jar, enabling unauthenticated RCE via the Firmware upload UI at /pages/jpages (Zip Slip). An attacker can upload a malicious archive that is extracted without...