https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-09T22:44:26.262971+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/cve-2024-24578 CVE-2024-24578 — RaspberryMatic Unauthenticated Remote Code Execution vulnerability through HMServer File Upload 2026-10-09T22:44:26.279301+00:00

Affected: jens-maus RaspberryMatic, raspberrymatic

RaspberryMatic is an open-source operating system for HomeMatic internet-of-things devices. RaspberryMatic / OCCU prior to version 3.75.6.20240316 contains a unauthenticated remote code execution (RCE) vulnerability, caused by multiple issues within the Java based `HMIPServer.jar` component. RaspberryMatric includes a Java based `HMIPServer`, that can be accessed through URLs starting with `/pages/jpages`. The `FirmwareController` class does however not perform any session id checks, thus this feature can be accessed without a valid session. Due to this issue, attackers can gain remote code execution as root user, allowing a full system compromise. Version 3.75.6.20240316 contains a patch.