Threats tagged 'ghsa-3ggr-5p57-2xgh'

A critical vulnerability exists in the firmware upgrade function of the admin web interface for Rittal IoT Interface and CMC III Processing Unit devices. The function verifies patch files using a signing process based on an HMAC with a hard-coded key embedded in the firmware. This key is publicly accessible, enabling attackers to craft malicious patch files that appear properly signed. Exploiting this flaw allows arbitrary code execution on the affected devices.