Vulnerability Information
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
RaspberryMatic Unauthenticated Remote Code Execution vulnerability through HMServer File Upload
Vulnerability Description
RaspberryMatic is an open-source operating system for HomeMatic internet-of-things devices. RaspberryMatic / OCCU prior to version 3.75.6.20240316 contains a unauthenticated remote code execution (RCE) vulnerability, caused by multiple issues within the Java based `HMIPServer.jar` component. RaspberryMatric includes a Java based `HMIPServer`, that can be accessed through URLs starting with `/pages/jpages`. The `FirmwareController` class does however not perform any session id checks, thus this feature can be accessed without a valid session. Due to this issue, attackers can gain remote code execution as root user, allowing a full system compromise. Version 3.75.6.20240316 contains a patch.
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Vulnerability Type
相对路径遍历
Vulnerability Title
RaspberryMatic 安全漏洞
Vulnerability Description
RaspberryMatic是德国Jens Maus个人开发者的一种免费且非商业的开源操作系统替代方案。用于运行无云的智能家居物联网中心。 RaspberryMatic 3.75.6.20240316之前版本存在安全漏洞，该漏洞源于基于 Java 的HMIPServer.jar组件内存在多个安全问题，攻击者利用该漏洞可以通过 HMServer 文件执行远程代码。
CVSS Information
N/A
Vulnerability Type
N/A