RaspberryMatic Unauthenticated Remote Code Execution vulnerability through HMServer File Upload

{
  "id": "30a14cd188d7dce616b7f00022ccbdb41aaf5e69e309cd7ce7a147186bb89129",
  "url": "https://osv.dev/vulnerability/CVE-2024-24578",
  "method": "structured",
  "payload": {
    "kind": "advisory",
    "title": "RaspberryMatic Unauthenticated Remote Code Execution vulnerability through HMServer File Upload",
    "summary": "RaspberryMatic is an open-source operating system for HomeMatic internet-of-things devices. RaspberryMatic / OCCU prior to version 3.75.6.20240316 contains a unauthenticated remote code execution (RCE) vulnerability, caused by multiple issues within the Java based `HMIPServer.jar` component. RaspberryMatric includes a Java based `HMIPServer`, that can be accessed through URLs starting with `/pages/jpages`. The `FirmwareController` class does however not perform any session id checks, thus this feature can be accessed without a valid session. Due to this issue, attackers can gain remote code execution as root user, allowing a full system compromise. Version 3.75.6.20240316 contains a patch.",
    "evidence": "osv:CVE-2024-24578",
    "products": [],
    "severity": "critical",
    "structured": {
      "id": "CVE-2024-24578",
      "aliases": [
        "CVE-2024-24578",
        "GHSA-q967-q4j8-637h"
      ],
      "metrics": [
        {
          "type": "CVSS_V3",
          "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H"
        }
      ],
      "affected": [
        {
          "ranges": [
            {
              "repo": "https://github.com/OpenCCU/OpenCCU",
              "type": "GIT",
              "events": [
                {
                  "introduced": "0"
                },
                {
                  "fixed": "9e2072a7686cb1d86449f400d519cff38ddd9648"
                }
              ],
              "database_specific": {
                "extracted_events": [
                  {
                    "range": [
                      {
                        "introduced": "0"
                      },
                      {
                        "fixed": "3.75.6.20240316"
                      }
                    ],
                    "source": "AFFECTED_FIELD",
                    "strategy": "StringRangeExpression"
                  }
                ]
              }
            }
          ],
          "versions": [
            "3.73.9.20240130",
            "3.73.9.20231130",
            "3.71.12.20231020",
            "3.71.12.20231014",
            "3.71.12.20230826",
            "3.69.7.20230626",
            "3.69.7.20230506",
            "3.69.6.20230407",
            "3.67.10.20230225",
            "3.67.10.20230114",
            "3.65.11.20221218",
            "3.65.11.20221005",
            "3.65.8.20220831",
            "3.65.6.20220723",
            "3.63.9.20220625",
            "3.63.9.20220521",
            "3.63.9.20220430",
            "3.63.8.20220330",
            "3.51.6.20200621",
            "3.51.6.20200613",
            "3.51.6.20200420",
            "3.51.6.20200229",
            "3.49.17.20200131",
            "snapshots",
            "3.49.17.20191225",
            "3.47.22.20191130",
            "3.47.10.20190713",
            "3.45.7.20190622",
            "3.45.7.20190511",
            "3.45.7.20190504",
            "3.45.5.20190330",
            "3.43.15.20190223",
            "3.41.11.20190126",
            "3.41.11.20181222",
            "3.41.11.20181126",
            "3.41.11.20181124",
            "3.37.8.20181026",
            "3.37.8.20180929",
            "3.37.8.20180922",
            "2.35.16.20180715",
            "2.35.16.20180708",
            "2.31.25.20180526",
            "2.31.25.20180324",
            "2.29.23.20171118",
            "2.29.23.20171022",
            "2.29.22.20171007",
            "2.29.22.20170902",
            "2.29.18.20170731",
            "2.27.8.20170620",
            "2.27.8.20170615",
            "2.27.8.20170501",
            "2.27.8.20170413",
            "2.27.8.20170410",
            "2.27.7.20170316",
            "2.25.15.20161220",
            "2.21.10.20160821",
            "2.15.5.20151101"
          ],
          "database_specific": {
            "source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-24578.json"
          }
        }
      ],
      "modified": "2026-10-28T02:30:32.469135409Z",
      "provider": "osv",
      "references": [
        "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/24xxx/CVE-2024-24578.json",
        "https://github.com/jens-maus/RaspberryMatic/security/advisories/GHSA-q967-q4j8-637h",
        "https://nvd.nist.gov/vuln/detail/CVE-2024-24578"
      ],
      "provider_metadata": {
        "cwe_ids": [
          "CWE-23",
          "CWE-306"
        ],
        "cna_assigner": "GitHub_M",
        "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/24xxx/CVE-2024-24578.json"
      }
    },
    "related_cves": [
      {
        "value": "CVE-2024-24578",
        "evidence": "/id"
      }
    ],
    "security_relevant": true,
    "severity_evidence": "/severity/0/score"
  },
  "source_id": "core-osv",
  "document_id": 499460,
  "published_at": "2024-03-18T21:13:03.626+00:00"
}