TI-2024-28437 Aliases CVE-2024-42469 GHSA-f729-58x4-gqgf

CometVisu Backend for openHAB affected by RCE through path traversal

MEDIUM 51CWE-22Published 2024-08-09 · Updated 2024-08-09

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: —
Confidentiality · integrity · availability: High · High · High
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub.

Summary

openHAB, a provider of open-source home automation software, has add-ons including the visualization add-on CometVisu. Prior to version 4.2.1, CometVisu's file system endpoints don't require authentication and additionally the endpoint to update an existing file is susceptible to path traversal. This makes it possible for an attacker to overwrite existing files on the openHAB instance. If the overwritten file is a shell script that is executed at a later time, this vulnerability can allow remote code execution by an attacker. Users should upgrade to version 4.2.1 to receive a patch.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.01211 68th percentileScored 2026-11-07

Fix Fixed openhab-webui (openhab): 4.2.1org.openhab.ui.bundles:org.openhab.ui.cometvisu (Maven): 4.2.1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: Yes
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
openhab	openhab-webui	before 4.2.1	4.2.1	Patch available	CNA
—	org.openhab.ui.bundles:org.openhab.ui.cometvisu (Maven)	before 4.2.1	4.2.1	Patch available	GHSA-f729-58x4-gqgf

openhab-webui Vendoropenhab Affected before 4.2.1 Fixed in 4.2.1 Patch available CNA
org.openhab.ui.bundles:org.openhab.ui.cometvisu (Maven) Vendor— Affected before 4.2.1 Fixed in 4.2.1 Patch available GHSA-f729-58x4-gqgf

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:openhab:openhab::::::::	before 4.2.1	Vulnerable	openhab

cpe:2.3:a:openhab:openhab:*:*:*:*:*:*:*:* Versions before 4.2.1 Vulnerable ·openhab

Remediation

Fix · CNA openhab-webui (openhab) Fixed in 4.2.1
Fix · GHSA-f729-58x4-gqgf org.openhab.ui.bundles:org.openhab.ui.cometvisu (Maven) Fixed in 4.2.1 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2024-42469
2026-10-03 Alias added: GHSA-f729-58x4-gqgf

References

Patch 1

https://github.com/openhab/openhab-webui/commit/630e8525835c698cf58856aa43782d92b18087f2

Advisory 2

Other 1

https://github.com/openhab/openhab-webui

TI-2024-28438 CometVisu Backend for openHAB has a sensitive information disclosure vulnerability CVSS 3.1CRITICAL 9.1
TI-2020-04298 openHAB exec add-ons allow remote arbitrary command execution CVSS 3.1HIGH 8.8
TI-2024-28436 Path traversal (CometVisu) CVSS 3.1HIGH 7.5
TI-2021-04367 XXE vulnerability in OpenHAB CVSS 3.1MEDIUM 6.4

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences