CVE-2024-47945

The session identifier generation algorithm uses an uninitialized rand() function without a prior srand() call, which means the only effective seed for the generator is the process PID. As a result, the total number of possible session identifier values for a single user is only 32,768. An attacker can pre-generate all possible session identifier values (pre-generation) and then use one of them to gain unauthorized access to an active session.

A remote unauthenticated attacker can hijack an active session of any user, gaining full unauthorized access to the device — including its configuration, data, and management functions.

Patches available from the manufacturer should be applied according to the references (https://www.rittal.com/de-de/products/deep/3124300 and https://r.sec-consult.com/rittaliot). Until the fix is implemented, it is recommended to restrict network access to device management interfaces using firewalls or network segmentation.

Rittal IoT Interface (firmware and device) and Rittal CMC III Processing Units (firmware and device) — specific versions indicated in the manufacturer's references