Is CVE-2024-24578 actively exploited?

No active exploitation of CVE-2024-24578 has been confirmed so far. Continue monitoring, as exploit status can change.

Can CVE-2024-24578 be exploited remotely?

Yes. CVE-2024-24578 is exploitable remotely over the network (CVSS attack vector: Network).

What is the CVSS score of CVE-2024-24578?

CVE-2024-24578 has a CVSS score of 9.8 (CRITICAL).

HOME VULNERABILITIESCVE-2024-24578

CRITICAL

CVE-2024-24578

CWE-23Published: March 18, 2024· Updated: Jun 17, 2026

9.8

CVSS v3.1

Official Description

RaspberryMatic is an open-source operating system for HomeMatic internet-of-things devices. RaspberryMatic / OCCU prior to version 3.75.6.20240316 contains a unauthenticated remote code execution (RCE) vulnerability, caused by multiple issues within the Java based `HMIPServer.jar` component. RaspberryMatric includes a Java based `HMIPServer`, that can be accessed through URLs starting with `/pages/jpages`. The `FirmwareController` class does however not perform any session id checks, thus this feature can be accessed without a valid session. Due to this issue, attackers can gain remote code execution as root user, allowing a full system compromise. Version 3.75.6.20240316 contains a patch.

NVD Source

Risk Analysis

RaspberryMatic contains a critical remote code execution vulnerability in the HMIPServer component due to missing session validation. An unauthenticated attacker can execute commands as root, leading to full system compromise.

No public exploit is known, and it is not in CISA KEV. The vulnerability is remotely exploitable with low complexity.

Recommended Action

Upgrade to RaspberryMatic version 3.75.6.20240316 or later to secure the HMIPServer component.

Generated by the CTIWATCH analysis pipeline from this CVE's metadata (CVSS, EPSS, KEV status, exploit intelligence). Verify against vendor advisories before acting.

Technical Analysis

CVE-2024-24578 can be exploited remotely over the network without requiring physical or adjacent access, significantly expanding the attack surface for threat actors.

The vulnerability requires no privileges and no user interaction, making it a prime target for automated exploitation campaigns and worm-like propagation.

A successful exploit results in complete confidentiality breach (data exposure), full integrity compromise (data manipulation), availability disruption (denial of service), with a CVSS base score of 9.8.