Code injection in SE-elektronic GmbH E-DDC3.3
Priority MEDIUM 52CWE-94Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-94.
Summary
Remote command execution vulnerability in SE-elektronic GmbH E-DDC3.3 affecting versions 03.07.03 and higher. An attacker could send different commands from the operating system to the system via the web configuration functionality of the device.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.01751 78th percentileScored 2026-11-07
Fix Fixed E-DDC3.3 (SE-elektronic GmbH): 03.08.52
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| SE-elektronic GmbH | E-DDC3.3 | 03.07.03 | 03.08.52 | Patch available | CNA |
- E-DDC3.3 VendorSE-elektronic GmbH Affected 03.07.03 Fixed in 03.08.52 Patch available CNA
CPE configurations NVD · 2
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:se-elektronic:e-ddc3.3_firmware:03.07.03:*:*:*:*:*:*:* | 03.07.03 | Vulnerable | SE-elektronic GmbH |
| cpe:2.3:h:se-elektronic:e-ddc3.3:-:*:*:*:*:*:*:* | not specified by NVD | Running on | SE-elektronic GmbH |
- cpe:2.3:o:se-elektronic:e-ddc3.3_firmware:03.07.03:*:*:*:*:*:*:* Versions 03.07.03 Vulnerable ·SE-elektronic GmbH
- cpe:2.3:h:se-elektronic:e-ddc3.3:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·SE-elektronic GmbH
Remediation
- Fix · CNA E-DDC3.3 (SE-elektronic GmbH) Fixed in 03.08.52
Fixed in the same release
Records fixed by the same vendor advisory or release, as the CNA lists them.
- Advisory ·
SE-elektronic E-DDC3.3 — se-elektronic.com/psirt-cybersecurity
2 records Highest priority Priority HIGH 1 HIGH, 1 MEDIUM
Other records, highest priority first
- TI-2024-00937 Uncontrolled resource consumption in SE-elektronic GmbH E-DDC3.3Priority HIGH 66
Timeline
- 2026-10-02 Threatist record created from CVE-2024-1015
- 2026-10-03 Alias added: GHSA-9x52-pxhj-x4j7
References
Patch 2
More SE-elektronic GmbH E-ddc3.3 Firmware vulnerabilities
- TI-2024-00937 Uncontrolled resource consumption in SE-elektronic GmbH E-DDC3.3 CVSS 3.1HIGH 7.5
Sources
- CVE-2024-1015 · CVE Program
- CVE-2024-1015 · NVD
- FIRST EPSS
- GHSA-9x52-pxhj-x4j7 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences