CVE Feed

    Dashboard / CVE / CVE-2024-24578

    CVE-2024-24578

    RaspberryMatic is an open-source operating system for HomeMatic internet-of-things devices. RaspberryMatic / OCCU prior to version 3.75.6.20240316 contains a unauthenticated remote code execution (RCE) vulnerability, caused by multiple issues within the Java based `HMIPServer.jar` component. RaspberryMatric includes a Java based `HMIPServer`, that can be accessed through URLs starting with `/pages/jpages`. The `FirmwareController` class does however not perform any session id checks, thus this feature can be accessed without a valid session. Due to this issue, attackers can gain remote code execution as root user, allowing a full system compromise. Version 3.75.6.20240316 contains a patch.

    Published:Mar 18, 2024
    Last Modified:Dec 23, 2025
    EPS:Mar 18, 2024
    EPSS Score:0.55581
    CVSS Score:10

    Affected Products

    Vendor
    Raspberrymatic
    Product
    Raspberrymatic

    Exploits

    https://github.com/jens-maus/RaspberryMatic/security/advisories/GHSA-q967-q4j8-637hhttps://github.com/jens-maus/RaspberryMatic/security/advisories/GHSA-q967-q4j8-637h

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High