[Update 20/07/2026] Multiple vulnerabilities in SE-elektronic GmbH products

Posted date 29/01/2024

Identificador

INCIBE-2024-0046

Importance

5 - Critical

Affected Resources

E-DDC3.3, versions 03.07.03 and later.

Description

INCIBE has coordinated the publication of 2 vulnerabilities: one of critical severity and one of medium severity, affecting E-DDC3.3SE-elektronic GmbH, versions 03.07.03 and higher, a company focused on building automation, which have been discovered by Carlos Antonini.

These vulnerabilities have been assigned the following codes, with the same CVSS v3.1 base score, CVSS vector and the CWE vulnerability type of each vulnerability:

CVE-2024-1014: 6.2 | CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H | CWE-400
CVE-2024-1015: 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H | CWE-94

Solution

[Update 20/07/2026]

The vulnerabilities have been fixed through a firmware update. SE-elektronic GmbH has published an official security advisory covering both vulnerabilities:

Fixed firmware version: V03.08.52.
Firmware release date: 2026-01-27
Vendor advisory publication date: 2026-07-16

Detail

CVE-2024-1014: uncontrolled resource consumption vulnerability in SE-elektronic GmbH E-DDC3.3 affecting versions 03.07.03 and higher. An attacker could interrupt the availability of the administration panel by sending multiple ICMP packets.
CVE-2024-1015: remote command execution vulnerability in SE-elektronic GmbH E-DDC3.3 affecting versions 03.07.03 and higher. An attacker could send different commands from the operating system to the system via the web configuration functionality of the device.

CVE