How severe is CVE-2024-24578?

CVE-2024-24578 has a CVSS 3.x base score of 10.0, rated critical severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is high, integrity high, and availability high.

Is CVE-2024-24578 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 9% (95th percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2024-24578?

CVE-2024-24578 affects Raspberrymatic. See the affected-products list for the exact vulnerable versions.

How do I fix CVE-2024-24578?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its critical severity, prioritise patching exposed systems.

Does CVE-2024-24578 have an EU (EUVD) identifier?

Yes. CVE-2024-24578 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2024-21983.

When was CVE-2024-24578 published?

CVE-2024-24578 was published on 2024-03-18 and last updated on 2026-06-17.

CVE-2024-24578

CVE-2024-24578 is a critical-severity vulnerability in Raspberrymatic with a CVSS 3.x base score of 10.0. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-23.

Key facts

Severity: Critical (CVSS 3.x base score 10.0)
EPSS exploit prediction: 9% (95th percentile)
Actively exploited: Not listed in CISA KEV
EU (EUVD) id: EUVD-2024-21983
Weakness: CWE-23
Affected product: Raspberrymatic
Published: 2024-03-18
Last modified: 2026-06-17

Description

RaspberryMatic is an open-source operating system for HomeMatic internet-of-things devices. RaspberryMatic / OCCU prior to version 3.75.6.20240316 contains a unauthenticated remote code execution (RCE) vulnerability, caused by multiple issues within the Java based `HMIPServer.jar` component. RaspberryMatric includes a Java based `HMIPServer`, that can be accessed through URLs starting with `/pages/jpages`. The `FirmwareController` class does however not perform any session id checks, thus this feature can be accessed without a valid session. Due to this issue, attackers can gain remote code execution as root user, allowing a full system compromise. Version 3.75.6.20240316 contains a patch.

Frequently asked questions

What is CVE-2024-24578?: RaspberryMatic is an open-source operating system for HomeMatic internet-of-things devices. RaspberryMatic / OCCU prior to version 3.75.6.20240316 contains a unauthenticated remote code execution (RCE) vulnerability, caused by multiple issues within the Java based `HMIPServer.jar` component. RaspberryMatric includes a Java based `HMIPServer`, that can be accessed through URLs starting with `/pages/jpages`. The `FirmwareController` class does however not perform any session id checks, thus this feature can be accessed without a valid session. Due to this issue, attackers can gain remote code execution as root user, allowing a full system compromise. Version 3.75.6.20240316 contains a patch.
How severe is CVE-2024-24578?: CVE-2024-24578 has a CVSS 3.x base score of 10.0, rated critical severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is high, integrity high, and availability high.
Is CVE-2024-24578 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 9% (95th percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2024-24578?: CVE-2024-24578 affects Raspberrymatic. See the affected-products list for the exact vulnerable versions.
How do I fix CVE-2024-24578?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its critical severity, prioritise patching exposed systems.
Does CVE-2024-24578 have an EU (EUVD) identifier?: Yes. CVE-2024-24578 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2024-21983.
When was CVE-2024-24578 published?: CVE-2024-24578 was published on 2024-03-18 and last updated on 2026-06-17.

References

https://github.com/jens-maus/RaspberryMatic/security/advisories/GHSA-q967-q4j8-637h

Affected products (1)

cpe:2.3:o:raspberrymatic:raspberrymatic:*:*:*:*:*:*:*:*

More vulnerabilities in Raspberrymatic

CVE-2022-24796 — Critical (CVSS 10.0): RaspberryMatic is a free and open-source operating system for running a cloud-free smart-home using the homematicIP /…

All CVEs affecting Raspberrymatic →

Other CWE-23 vulnerabilities

CVE-2026-52813 — Critical (CVSS 10.0): Gogs is an open source self-hosted Git service. Prior to 0.14.3, organization names containing path traversal sequences…
CVE-2026-8326 — Critical (CVSS 10.0): Path traversal vulnerability in Remote Spark (https://www.Remotespark.Com/) SparkView allows reading and writing…
CVE-2026-33494 — Critical (CVSS 10.0): ORY Oathkeeper is an Identity & Access Proxy (IAP) and Access Control Decision API that authorizes HTTP requests based…
CVE-2023-3941 — Critical (CVSS 10.0): Relative Path Traversal vulnerability in ZkTeco-based OEM devices allows an attacker to write any file on the system…
CVE-2012-6069 — Critical (CVSS 10.0): The CoDeSys Runtime Toolkit’s file transfer functionality does not perform input validation, which allows an…
CVE-2025-62878 — Critical (CVSS 9.9): A malicious user can manipulate the parameters.pathPattern to create PersistentVolumes in arbitrary locations on the…

Browse all CWE-23 vulnerabilities →