CVE-2024-1015
A critical vulnerability allows attackers to run arbitrary commands on SE‑elektronic E‑DDC3.3 devices via the web configuration interface. The flaw exists in firmware 03.07.03 and later and can be exploited remotely without authentication.
No official fix yet. If none appears within 45 days of first tracking, this entry is removed automatically.
Who is affected
SE‑elektronic GmbH E‑DDC3.3 firmware 03.07.03 and newer, commonly used in industrial control systems.
Real-world impact
An attacker could take full control of the device, execute any command, disrupt operations, or use the device as a foothold in a larger network.
Why this severity
The CVSS score of 9.8 reflects that the vulnerability is remotely exploitable with no authentication, provides complete compromise of confidentiality, integrity, and availability, and has low attack complexity.
What to do about it
- ›Restrict or disable the web configuration interface to prevent remote command execution.
No official fix or mitigation is documented in the sources yet. Monitor the vendor advisory and apply the patch as soon as it is released.
No fix documented in sources
Timeline
- Jan 29, 2024 · Jan 29, 2024PublishedDisclosed and added to the National Vulnerability Database.
- Jul 20, 2026 · 17d agoAdvisory updatedThe NVD record was last revised.