Rittal manufactures thermal management, power distribution, and infrastructure control products for data centers and industrial environments, with a focused portfolio including cooling units, power management appliances, and networked control interfaces. Vulnerabilities affecting the vendor skew strongly toward critical-severity outcomes and cluster around web-facing and command-injection attack surfaces—cross-site scripting, OS command injection, hard-coded credentials, and privilege-management flaws that recur across the CMC III and LCP control-firmware products. Defenders should prioritize visibility into Rittal infrastructure devices on their network perimeter and apply patches urgently given the severity tendency; live exploitation status and exposure counts are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Rittal over time
Signals from CVEs in this vendor scope (12 CVEs).
12 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2020-11956CRITICAL An issue was discovered on Rittal PDU-3C002DEC through 5.17.10 and CMCIII-PU-9333E0FB through 3.17.10 devices. There is a least privilege violation. | Jul 14, 2020 | 9.8 | 30 | NO | NO |
CVE-2019-13553CRITICAL Rittal Chiller SK 3232-Series web interface as built upon Carel pCOWeb firmware A1.5.3 – B1.2.4. The authentication mechanism on affected systems is configured using hard-coded cre | Oct 25, 2019 | 9.8 | 29 | NO | NO |
CVE-2024-47945CRITICAL The devices are vulnerable to session hijacking due to insufficient
entropy in its session ID generation algorithm. The session IDs are
predictable, with only 32,768 possible val | Oct 15, 2024 | 9.8 | 28 | NO | NO |
CVE-2020-11953HIGH An issue was discovered on Rittal PDU-3C002DEC through 5.15.40 and CMCIII-PU-9333E0FB through 3.15.70_4 devices. Attackers can execute code. | Jul 14, 2020 | 8.8 | 28 | NO | NO |
CVE-2021-40222HIGH Rittal CMC PU III Web management Version affected: V3.11.00_2. Version fixed: V3.17.10 is affected by a remote code execution vulnerablity. It is possible to introduce shell code t | Sep 9, 2021 | 7.2 | 24 | NO | NO |
CVE-2020-11951CRITICAL An issue was discovered on Rittal PDU-3C002DEC through 5.17.10 and CMCIII-PU-9333E0FB through 3.17.10 devices. There is a Backdoor root account. | Jul 14, 2020 | 9.8 | 24 | NO | NO |
CVE-2019-13549HIGH Rittal Chiller SK 3232-Series web interface as built upon Carel pCOWeb firmware A1.5.3 – B1.2.4. The authentication mechanism on affected systems does not provide a sufficient leve | Oct 25, 2019 | 7.5 | 23 | NO | NO |
CVE-2019-19393MEDIUM The Web application on Rittal CMC PU III 7030.000 V3.00 V3.11.00_2 to V3.15.70_4 devices fails to sanitize user input on the system configurations page. This allows an attacker to | Oct 1, 2020 | 6.1 | 22 | NO | NO |
CVE-2020-11955HIGH An issue was discovered on Rittal PDU-3C002DEC through 5.15.70 and CMCIII-PU-9333E0FB through 3.15.70 devices. There are insecure permissions. | Jul 14, 2020 | 8.8 | 22 | NO | NO |
CVE-2020-11952MEDIUM An issue was discovered on Rittal PDU-3C002DEC through 5.17.10 and CMCIII-PU-9333E0FB through 3.17.10 devices. Attackers can bypass the CLI menu. | Jul 14, 2020 | 6.2 | 21 | NO | NO |
Signals from CVEs in this vendor scope (12 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Rittal.
Media articles that mention a CVE ID that affects a product developed by Rittal — matched by CVE ID, not by vendor name.