Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2024-47945— Predictable Session ID

Quick assessment

Affected
RITTAL GmbH & Co. KG IoT Interface & CMC III Processing Unit
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Rittal IoT Interface & CMC III Processing Unit是德国Rittal公司的一个用于监控物理环境条件的传感器智能联网的关键组件。 Rittal IoT Interface & CMC III Processing Unit 6.21.00.2之前版本存在安全漏洞，该漏洞源于会话 ID 生成算法的熵不足，导致会话 ID 是可预测的，致使设备容易受到会话劫持。

AI Predicted 7.5 Difficulty: Easy EPSS 0.87% · P57

Possible ATT&CK Techniques 1 AI

T1133 · External Remote Services
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2024-47945

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Predictable Session ID
Source: CVE Program / CVE List V5
Vulnerability Description
The devices are vulnerable to session hijacking due to insufficient entropy in its session ID generation algorithm. The session IDs are predictable, with only 32,768 possible values per user, which allows attackers to pre-generate valid session IDs, leading to unauthorized access to user sessions. This is not only due to the use of an (insecure) rand() function call but also because of missing initialization via srand(). As a result only the PIDs are effectively used as seed.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
可预测问题
Source: CVE Program / CVE List V5
Vulnerability Title
Rittal IoT Interface & CMC III Processing Unit 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Rittal IoT Interface & CMC III Processing Unit是德国Rittal公司的一个用于监控物理环境条件的传感器智能联网的关键组件。 Rittal IoT Interface & CMC III Processing Unit 6.21.00.2之前版本存在安全漏洞，该漏洞源于会话 ID 生成算法的熵不足，导致会话 ID 是可预测的，致使设备容易受到会话劫持。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
RITTAL GmbH & Co. KG IoT Interface & CMC III Processing Unit <6.21.00.2 -

II. Public POCs for CVE-2024-47945

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2024-47945

请登录查看更多情报信息。

Vendor Advisories for CVE-2024-47945 (1)

Same Patch Batch · RITTAL GmbH & Co. KG · 2024-10-15 · 3 CVEs total

CVE-2024-47943 Improper signature verification of firmware upgrade files
CVE-2024-47944 Missing Protection Mechanism for Alternate Hardware Interface

IV. Related Vulnerabilities

Same product: IoT Interface & CMC III Processing Unit
Same vendor: RITTAL GmbH & Co. KG
Same weakness: CWE-340

V. Comments for CVE-2024-47945

No comments yet

Leave a comment