jens-maus RaspberryMatic prior 3.75.6.20240316 path traversal

Summaryinfo

A vulnerability, which was classified as very critical, was found in jens-maus RaspberryMatic. Affected by this vulnerability is an unknown functionality. Executing a manipulation can lead to path traversal. The identification of this vulnerability is CVE-2024-24578. The attack may be launched remotely. There is no exploit available. You should upgrade the affected component.

Detailsinfo

A vulnerability has been found in jens-maus RaspberryMatic and classified as very critical. This vulnerability affects some unknown functionality. The manipulation with an unknown input leads to a path traversal vulnerability. The CWE definition for the vulnerability is CWE-23. The product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize sequences such as ".." that can resolve to a location that is outside of that directory. As an impact it is known to affect confidentiality, integrity, and availability. CVE summarizes:

RaspberryMatic is an open-source operating system for HomeMatic internet-of-things devices. RaspberryMatic / OCCU prior to version 3.75.6.20240316 contains a unauthenticated remote code execution (RCE) vulnerability, caused by multiple issues within the Java based `HMIPServer.jar` component. RaspberryMatric includes a Java based `HMIPServer`, that can be accessed through URLs starting with `/pages/jpages`. The `FirmwareController` class does however not perform any session id checks, thus this feature can be accessed without a valid session. Due to this issue, attackers can gain remote code execution as root user, allowing a full system compromise. Version 3.75.6.20240316 contains a patch.

The advisory is shared for download at github.com. This vulnerability was named CVE-2024-24578 since 01/25/2024. The exploitation appears to be easy. The attack can be initiated remotely. No form of authentication is required for a successful exploitation. There are neither technical details nor an exploit publicly available. The current price for an exploit might be approx. USD $0-$5k (estimation calculated on 12/23/2025). The MITRE ATT&CK project declares the attack technique as T1006.

Upgrading to version 3.75.6.20240316 eliminates this vulnerability.

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Vendor

• jens-maus

Name

• RaspberryMatic

Website

• Product: https://github.com/jens-maus/RaspberryMatic/

CPE 2.3info

• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion