CVE-2022-24796

RaspberryMatic is a free and open-source operating system for running a cloud-free smart-home using the homematicIP / HomeMatic hardware line of IoT devices. A Remote Code Execution (RCE) vulnerability in the file upload facility of the WebUI interface of RaspberryMatic exists. Missing input validation/sanitization in the file upload mechanism allows remote, unauthenticated attackers with network access to the WebUI interface to achieve arbitrary operating system command execution via shell metacharacters in the HTTP query string. Injected commands are executed as root, thus leading to a full compromise of the underlying system and all its components. Versions after `2.31.25.20180428` and prior to `3.63.8.20220330` are affected. Users are advised to update to version `3.63.8.20220330` or newer. There are currently no known workarounds to mitigate the security impact and users are advised to update to the latest version available.

• CWE-78

• https://github.com/jens-maus/RaspberryMatic/commit/34854659a63e9fb3ad529bb413e96978c6450a53Patch, Third Party Advisory
• https://github.com/jens-maus/RaspberryMatic/security/advisories/GHSA-g7vv-7rmf-mff7Patch, Third Party Advisory
• https://github.com/jens-maus/RaspberryMatic/commit/34854659a63e9fb3ad529bb413e96978c6450a53Patch, Third Party Advisory
• https://github.com/jens-maus/RaspberryMatic/security/advisories/GHSA-g7vv-7rmf-mff7Patch, Third Party Advisory

Published

Mar 31, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-24790Puma is a simple, fast, multi-threaded, parallel HTTP 1.1 se…7.5
• CVE-2022-24791Wasmtime is a standalone JIT-style runtime for WebAssembly, …9.8
• CVE-2022-24792PJSIP is a free and open source multimedia communication lib…7.5
• CVE-2022-24793PJSIP is a free and open source multimedia communication lib…7.5
• CVE-2022-24794Express OpenID Connect is an Express JS middleware implement…6.1
• CVE-2022-24795yajl-ruby is a C binding to the YAJL JSON parsing and genera…7.5
• CVE-2022-24797Pomerium is an identity-aware access proxy. In distributed s…9.1
• CVE-2022-24798Internet Routing Registry daemon version 4 is an IRR databas…7.5
• CVE-2022-24799wire-webapp is the web application interface for the wire me…6.1
• CVE-2022-2480Use after free in Service Worker API in Google Chrome prior …8.8
• CVE-2022-24800October/System is the system module for October CMS, a self-…8.1
• CVE-2022-24801Twisted is an event-based framework for internet application…8.1