CVE-2024-24578

RaspberryMatic is an open-source operating system for HomeMatic internet-of-things devices. RaspberryMatic / OCCU prior to version 3.75.6.20240316 contains a unauthenticated remote code execution (RCE) vulnerability, caused by multiple issues within the Java based `HMIPServer.jar` component. RaspberryMatric includes a Java based `HMIPServer`, that can be accessed through URLs starting with `/pages/jpages`. The `FirmwareController` class does however not perform any session id checks, thus this feature can be accessed without a valid session. Due to this issue, attackers can gain remote code execution as root user, allowing a full system compromise. Version 3.75.6.20240316 contains a patch.

• CWE-23
• CWE-306

• https://github.com/jens-maus/RaspberryMatic/security/advisories/GHSA-q967-q4j8-637hExploit, Vendor Advisory
• https://github.com/jens-maus/RaspberryMatic/security/advisories/GHSA-q967-q4j8-637hExploit, Vendor Advisory

Published

Mar 18, 2024

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-24572facileManager is a modular suite of web apps built with the …6.5
• CVE-2024-24573facileManager is a modular suite of web apps built with the …8.8
• CVE-2024-24574phpMyFAQ is an open source FAQ web application for PHP 8.1+ …6.1
• CVE-2024-24575libgit2 is a portable C implementation of the Git core metho…7.5
• CVE-2024-24576Rust is a programming language. The Rust Security Response W…10
• CVE-2024-24577libgit2 is a portable C implementation of the Git core metho…9.8
• CVE-2024-24579stereoscope is a go library for processing container images …9.8
• CVE-2024-2458The Powerkit – Supercharge your WordPress Site plugin for Wo…5.4
• CVE-2024-24580Improper conditions check in some Intel(R) Data Center GPU M…5.5
• CVE-2024-24581in OpenHarmony v4.0.0 and prior versions allow a local attac…7.8
• CVE-2024-24582Improper input validation in XmlCli feature for UEFI firmwar…8.7
• CVE-2024-24583Multiple out-of-bounds read vulnerabilities exist in the rea…4.3