CVE Vulnerabilities

CVE-2024-22894

Inadequate Encryption Strength

Published: Jan 30, 2024 | Modified: Mar 05, 2024
CVSS 3.x
6.8
MEDIUM
Source:
NVD
CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 2.x
RedHat/V2
RedHat/V3
Ubuntu

An issue fixed in AIT-Deutschland Alpha Innotec Heatpumps V2.88.3 or later, V3.89.0 or later, V4.81.3 or later and Novelan Heatpumps V2.88.3 or later, V3.89.0 or later, V4.81.3 or later, allows remote attackers to execute arbitrary code via the password component in the shadow file.

Weakness

The product stores or transmits sensitive data using an encryption scheme that is theoretically sound, but is not strong enough for the level of protection required.

Affected Software

Name Vendor Start Version End Version
Heat_pumps_firmware Alpha-innotec * *
Heat_pumps_firmware Alpha-innotec 3.0.0 *
Heat_pumps_firmware Alpha-innotec 4.0.0 *

Potential Mitigations

References