Rittal
Products
7- 5 CVEs
- 5 CVEs
- 3 CVEs
- 2 CVEs
- 1 CVE
- 1 CVE
- 1 CVE
Recent CVEs
12| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2024-47943 | Cri | 0.64 | 9.8 | 0.01 | Oct 15, 2024 | The firmware upgrade function in the admin web interface of the Rittal IoT Interface & CMC III Processing Unit devices checks if the patch files are signed before executing the containing run.sh script. The signing process is kind of an HMAC with a long string as key which… | ||
| CVE-2021-40222 | 0.01 | — | 0.05 | Sep 9, 2021 | Rittal CMC PU III Web management Version affected: V3.11.00_2. Version fixed: V3.17.10 is affected by a remote code execution vulnerablity. It is possible to introduce shell code to create a reverse shell in the PU-Hostname field of the TCP/IP Configuration dialog. Web… | |||
| CVE-2022-40633 | 0.00 | — | 0.00 | Mar 2, 2023 | A malicious actor can clone access cards used to open control cabinets secured with Rittal CMC III locks. | |||
| CVE-2021-40223 | 0.00 | — | 0.01 | Sep 9, 2021 | Rittal CMC PU III Web management (version V3.11.00_2) fails to sanitize user input on several parameters of the configuration (User Configuration dialog, Task Configuration dialog and set logging filter dialog). This allows an attacker to backdoor the device with HTML and… | |||
| CVE-2019-19393 | 0.00 | — | 0.01 | Oct 1, 2020 | The Web application on Rittal CMC PU III 7030.000 V3.00 V3.11.00_2 to V3.15.70_4 devices fails to sanitize user input on the system configurations page. This allows an attacker to backdoor the device with HTML and browser-interpreted content (such as JavaScript or other… | |||
| CVE-2020-11956 | 0.00 | — | 0.02 | Jul 14, 2020 | An issue was discovered on Rittal PDU-3C002DEC through 5.17.10 and CMCIII-PU-9333E0FB through 3.17.10 devices. There is a least privilege violation. | |||
| CVE-2020-11955 | 0.00 | — | 0.01 | Jul 14, 2020 | An issue was discovered on Rittal PDU-3C002DEC through 5.15.70 and CMCIII-PU-9333E0FB through 3.15.70 devices. There are insecure permissions. | |||
| CVE-2020-11953 | 0.00 | — | 0.02 | Jul 14, 2020 | An issue was discovered on Rittal PDU-3C002DEC through 5.15.40 and CMCIII-PU-9333E0FB through 3.15.70_4 devices. Attackers can execute code. | |||
| CVE-2020-11952 | 0.00 | — | 0.01 | Jul 14, 2020 | An issue was discovered on Rittal PDU-3C002DEC through 5.17.10 and CMCIII-PU-9333E0FB through 3.17.10 devices. Attackers can bypass the CLI menu. | |||
| CVE-2020-11951 | 0.00 | — | 0.02 | Jul 14, 2020 | An issue was discovered on Rittal PDU-3C002DEC through 5.17.10 and CMCIII-PU-9333E0FB through 3.17.10 devices. There is a Backdoor root account. | |||
| CVE-2019-13553 | 0.00 | — | 0.02 | Oct 25, 2019 | Rittal Chiller SK 3232-Series web interface as built upon Carel pCOWeb firmware A1.5.3 – B1.2.4. The authentication mechanism on affected systems is configured using hard-coded credentials. These credentials could allow attackers to influence the primary operations of the… | |||
| CVE-2019-13549 | 0.00 | — | 0.01 | Oct 25, 2019 | Rittal Chiller SK 3232-Series web interface as built upon Carel pCOWeb firmware A1.5.3 – B1.2.4. The authentication mechanism on affected systems does not provide a sufficient level of protection against unauthorized configuration changes. Primary operations, namely turning… |
- risk 0.64cvss 9.8epss 0.01
The firmware upgrade function in the admin web interface of the Rittal IoT Interface & CMC III Processing Unit devices checks if the patch files are signed before executing the containing run.sh script. The signing process is kind of an HMAC with a long string as key which…
- CVE-2021-40222Sep 9, 2021risk 0.01cvss —epss 0.05
Rittal CMC PU III Web management Version affected: V3.11.00_2. Version fixed: V3.17.10 is affected by a remote code execution vulnerablity. It is possible to introduce shell code to create a reverse shell in the PU-Hostname field of the TCP/IP Configuration dialog. Web…
- CVE-2022-40633Mar 2, 2023risk 0.00cvss —epss 0.00
A malicious actor can clone access cards used to open control cabinets secured with Rittal CMC III locks.
- CVE-2021-40223Sep 9, 2021risk 0.00cvss —epss 0.01
Rittal CMC PU III Web management (version V3.11.00_2) fails to sanitize user input on several parameters of the configuration (User Configuration dialog, Task Configuration dialog and set logging filter dialog). This allows an attacker to backdoor the device with HTML and…
- CVE-2019-19393Oct 1, 2020risk 0.00cvss —epss 0.01
The Web application on Rittal CMC PU III 7030.000 V3.00 V3.11.00_2 to V3.15.70_4 devices fails to sanitize user input on the system configurations page. This allows an attacker to backdoor the device with HTML and browser-interpreted content (such as JavaScript or other…
- CVE-2020-11956Jul 14, 2020risk 0.00cvss —epss 0.02
An issue was discovered on Rittal PDU-3C002DEC through 5.17.10 and CMCIII-PU-9333E0FB through 3.17.10 devices. There is a least privilege violation.
- CVE-2020-11955Jul 14, 2020risk 0.00cvss —epss 0.01
An issue was discovered on Rittal PDU-3C002DEC through 5.15.70 and CMCIII-PU-9333E0FB through 3.15.70 devices. There are insecure permissions.
- CVE-2020-11953Jul 14, 2020risk 0.00cvss —epss 0.02
An issue was discovered on Rittal PDU-3C002DEC through 5.15.40 and CMCIII-PU-9333E0FB through 3.15.70_4 devices. Attackers can execute code.
- CVE-2020-11952Jul 14, 2020risk 0.00cvss —epss 0.01
An issue was discovered on Rittal PDU-3C002DEC through 5.17.10 and CMCIII-PU-9333E0FB through 3.17.10 devices. Attackers can bypass the CLI menu.
- CVE-2020-11951Jul 14, 2020risk 0.00cvss —epss 0.02
An issue was discovered on Rittal PDU-3C002DEC through 5.17.10 and CMCIII-PU-9333E0FB through 3.17.10 devices. There is a Backdoor root account.
- CVE-2019-13553Oct 25, 2019risk 0.00cvss —epss 0.02
Rittal Chiller SK 3232-Series web interface as built upon Carel pCOWeb firmware A1.5.3 – B1.2.4. The authentication mechanism on affected systems is configured using hard-coded credentials. These credentials could allow attackers to influence the primary operations of the…
- CVE-2019-13549Oct 25, 2019risk 0.00cvss —epss 0.01
Rittal Chiller SK 3232-Series web interface as built upon Carel pCOWeb firmware A1.5.3 – B1.2.4. The authentication mechanism on affected systems does not provide a sufficient level of protection against unauthorized configuration changes. Primary operations, namely turning…