彙總 rittal 相關全部產品的 CVE 與安全漏洞情報，包括 CVSS、EPSS、公開時間與漏洞情報資料。
已披露問題常與 跨站腳本 相關，可能在 生產負載與軟體部署 場景中帶來 工作階段劫持 等暴露風險。
相關漏洞資料主要來源於公開漏洞披露與安全公告，可用於評估歷史漏洞暴露面與修補優先順序。
| CVE | 摘要 | 來源 | 最高 CVSS | EPSS % | 公開時間 | 更新時間 |
|---|---|---|---|---|---|---|
| CVE-2024-47945 | The devices are vulnerable to session hijacking due to insufficient entropy in its session ID generation algorithm. The session IDs are predictable, with only 32,768 possible values per user, which allows attackers to pre-generate valid session IDs, leading to unauthorized access to user sessions. This is not only due to the use of an (insecure) rand() function call but also because of missing initialization via srand(). As a result only the PIDs are effectively used as seed. | 551230f0-3615-47bd-b7cc-93e92e730bbf | 9.8 | 0.86% | 2024-10-15 | 2026-06-17 |
| CVE-2022-40633 | A malicious actor can clone access cards used to open control cabinets secured with Rittal CMC III locks. | [email protected] | 4.6 | 0.26% | 2023-03-02 | 2026-06-17 |
| CVE-2021-40223 | Rittal CMC PU III Web management (version V3.11.00_2) fails to sanitize user input on several parameters of the configuration (User Configuration dialog, Task Configuration dialog and set logging filter dialog). This allows an attacker to backdoor the device with HTML and browser-interpreted content (such as JavaScript or other client-side scripts). The XSS payload will be triggered when the user accesses some specific sections of the application. | [email protected] | 5.4 | 0.60% | 2021-09-09 | 2026-06-17 |
| CVE-2021-40222 | Rittal CMC PU III Web management Version affected: V3.11.00_2. Version fixed: V3.17.10 is affected by a remote code execution vulnerablity. It is possible to introduce shell code to create a reverse shell in the PU-Hostname field of the TCP/IP Configuration dialog. Web application fails to sanitize user input on Network TCP/IP configuration page. This allows the attacker to inject commands as root on the device which will be executed once the data is received. | [email protected] | 7.2 | 4.69% | 2021-09-09 | 2026-06-17 |
| CVE-2019-19393 | The Web application on Rittal CMC PU III 7030.000 V3.00 V3.11.00_2 to V3.15.70_4 devices fails to sanitize user input on the system configurations page. This allows an attacker to backdoor the device with HTML and browser-interpreted content (such as JavaScript or other client-side scripts) as the content is always displayed after and before login. Persistent XSS allows an attacker to modify displayed content or to change the victim's information. Successful exploitation requires access to the w | [email protected] | 6.1 | 0.84% | 2020-10-01 | 2026-06-16 |
| CVE-2020-11956 | An issue was discovered on Rittal PDU-3C002DEC through 5.17.10 and CMCIII-PU-9333E0FB through 3.17.10 devices. There is a least privilege violation. | [email protected] | 9.8 | 1.62% | 2020-07-14 | 2026-06-16 |
| CVE-2020-11955 | An issue was discovered on Rittal PDU-3C002DEC through 5.15.70 and CMCIII-PU-9333E0FB through 3.15.70 devices. There are insecure permissions. | [email protected] | 8.8 | 1.31% | 2020-07-14 | 2026-06-16 |
| CVE-2020-11953 | An issue was discovered on Rittal PDU-3C002DEC through 5.15.40 and CMCIII-PU-9333E0FB through 3.15.70_4 devices. Attackers can execute code. | [email protected] | 8.8 | 2.47% | 2020-07-14 | 2026-06-16 |
| CVE-2020-11952 | An issue was discovered on Rittal PDU-3C002DEC through 5.17.10 and CMCIII-PU-9333E0FB through 3.17.10 devices. Attackers can bypass the CLI menu. | [email protected] | 6.2 | 0.53% | 2020-07-14 | 2026-06-16 |
| CVE-2020-11951 | An issue was discovered on Rittal PDU-3C002DEC through 5.17.10 and CMCIII-PU-9333E0FB through 3.17.10 devices. There is a Backdoor root account. | [email protected] | 9.8 | 1.65% | 2020-07-14 | 2026-06-16 |