CVE-2024-42470: openHAB, a provider of open-source home automation software, has add-ons including the visualization add-on CometVisu. Several endpoints in versions prior to…

PriorityP355critical9.1CVSS 3.1

AVNACLPRNUINSUCHIHAN

EPSS

0.52%

40.3th percentile

openHAB, a provider of open-source home automation software, has add-ons including the visualization add-on CometVisu. Several endpoints in versions prior to 4.2.1 of the CometVisu add-on of openHAB don't require authentication. This makes it possible for unauthenticated attackers to modify or to steal sensitive data. This issue may lead to sensitive information disclosure. Users should upgrade to version 4.2.1 of the CometVisu add-on of openHAB to receive a patch.

Affected

2 ranges

Vendor	Product	Version range	Fixed in
openhab	openhab	< 4.2.1	4.2.1
openhab	openhab-webui	< 4.2.1	4.2.1

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.