CVE-2024-1014 is a medium severity denial of service flaw, scored 6.2, in SE-elektronic E-DDC3.3 firmware 03.07.03 and later. Multiple ICMP packets can interrupt the administration panel. The vendor advisory, as summarised by INCIBE CERT, lists firmware V03.08.52 as the fix, so update affected units and limit who can reach them.
What's affected
Affected: SE-elektronic E-DDC3.3 firmware 03.07.03 and later. The record's CVSS 3.1 score is 6.2 (medium), with vector CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. The record describes multiple ICMP packets interrupting the administration panel. The weakness is filed as CWE-400.
The INCIBE CERT notice lists firmware 03.07.03 and later as affected and V03.08.52 as the fixed release. It rates this CVE the same way as NVD, but it lists the attack vector as local even though the description speaks of network traffic. Check the vendor advisory for the exact conditions.
Fixed version: The vendor advisory, as summarised by INCIBE CERT, lists firmware V03.08.52 (released 27 January 2026) as the fix.
How to check if you're exposed
- Inventory E-DDC3.3 units and read the firmware version from the device. Versions 03.07.03 and later and below V03.08.52 are in scope.
- Find out which networks can reach each unit's web configuration and administration panel.
- Check which networks can reach the device and whether ping traffic to it is filtered at a firewall. Monitor the administration panel for unexplained unavailability.
- Check the vendor PSIRT page and CSAF advisory for the current firmware.
What to do now
- Update affected units to firmware V03.08.52 or later, following the vendor's instructions.
- Until then, keep the web configuration and administration panel off untrusted networks, and filter traffic to the device at a firewall.
- Record the firmware version of every unit so the next advisory is quick to triage.
- Subscribe to the vendor PSIRT notices.
Why it matters
Uncontrolled resource consumption means the device does not limit how much work an outsider can make it do. Here the record says multiple ICMP packets can interrupt the availability of the administration panel.
The advisory vector marks the attack as local, while the description speaks of ICMP packets, which usually travel over a network. That mismatch is worth noting, and the vendor advisory is the source to check for the exact conditions.
The INCIBE notice reports no exploitation. Treat that as a statement about what was known when it was written, and check the vendor PSIRT page for updates.
Quick check
Is this CVE exploited in the wild?
The record's kev flag is false, so it is not in the CISA Known Exploited Vulnerabilities catalog, and no source I read reports active exploitation. The record does not mention a public exploit. That is a reason to patch or contain it soon, not a report of attacks.
Does the firmware update fix both CVEs?
The INCIBE CERT summary says the vulnerabilities in the notice were fixed through firmware V03.08.52. Confirm against the vendor advisory for your unit.
Sources
Last reviewed: 19 October 2026.
