Security Resilience

CVE-2024-22894

Crypto Weakness in Alpha-Innotec Heat Pumps Firmware ≤ 2.88.3

Public PoCCrypto Weakness
Published
30 January 2024
Modified
17 June 2026
CVSS Score v3.1 6.8
Click a component to see what it means
Raw vectorCVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0073 53th percentile
Risk Priority 56 floored blend · peak EPSS

CVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). Risk Priority is our own derived reading, not an NVD score.

Summary

CVE-2024-22894 is a medium-severity Inadequate Encryption Strength (CWE-326) vulnerability in Alpha-Innotec Heat Pumps Firmware. Its CVSS base score is 6.8 (Medium).

Operationally, ranked in the top 47% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

The strongest mitigations our analysis identified map to SC-13 (Cryptographic Protection) and SC-12 (Cryptographic Key Establishment and Management) — see the control section below for these in your framework.

OWASP Top 10 for Web (2025)

A04:2025 Cryptographic Failures

EU & UK References

Vulnerability Data

An issue fixed in AIT-Deutschland Alpha Innotec Heatpumps V2.88.3 or later, V3.89.0 or later, V4.81.3 or later and Novelan Heatpumps V2.88.3 or later, V3.89.0 or later, V4.81.3 or later, allows remote attackers to execute arbitrary code via the password component…

more

in the shadow file.

CWE(s)
CWE-326

Related Threats

CVEs Like This One

CVE-2023-23597Shared CWE-326
CVE-2023-21443Shared CWE-326
CVE-2023-47370Shared CWE-326
CVE-2024-39928Shared CWE-326
CVE-2024-40719Shared CWE-326
CVE-2025-46626Shared CWE-326
CVE-2025-12478Shared CWE-326
CVE-2023-44690Shared CWE-326
CVE-2024-52317Shared CWE-326
CVE-2024-33662Shared CWE-326

Affected Assets

alpha-innotec
heat pumps firmware
≤ 2.88.3 · 3.0.0 — 3.89.0 · 4.0.0 — 4.81.3
novelan
heat pumps firmware
≤ 2.88.3 · 3.0.0 — 3.89.0 · 4.0.0 — 4.81.3

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

SC-13 Cryptographic Protection good match

SC-13 requires selection and implementation of specific cryptographic algorithms and key lengths, directly preventing use of inadequate encryption strength.

SC-12 Cryptographic Key Establishment and Management partial match

SC-12 governs cryptographic key establishment and management, which can enforce sufficient key sizes and thereby reduce inadequate encryption strength.

Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.

A.8.24 Use of cryptography partial match
blocks

Requiring the organization to define and enforce minimum cryptographic strength prevents deployment of insufficient key lengths or weak ciphers that can be brute-forced.

Hardening callouts derived

DISA STIG baselines are authored against specific weaknesses. Where this CVE cites a broad weakness class, the mapping is not asserted at that abstraction (owner ruling, 2026-09-25: grade only at Base and below), so no rule is shown here rather than a rule shown against the wrong grain.

  • No fine-grained STIG row for CWE-326, a class-level weakness. Rules are authored against its narrower children: CWE-328.

References