PT-2023-31424 · Dalmann · Ocpp.Core

Gaetano Coppoletta · Publicado 2023-12-07 · Atualizado 2024-10-09 · CVE-2023-49958

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Dalmann OCPP.Core versions 1.2.0 and earlier

Description An issue was discovered in Dalmann OCPP.Core for OCPP (Open Charge Point Protocol) for electric vehicles. The server processes mishandle StartTransaction messages containing additional, arbitrary properties, or duplicate properties. The last occurrence of a duplicate property is accepted. This could be exploited to alter transaction records or impact system integrity.

Recommendations For versions 1.2.0 and earlier, as a temporary workaround, consider restricting the handling of StartTransaction messages to prevent the acceptance of additional or duplicate properties until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

RCE

Enumeração de Fraquezas

CWE-20

Identificadores relacionados

CVE-2023-49958

Produtos afetados

Ocpp.Core

Referências · 7

• 🔥 https://github.com/dallmann-consulting/OCPP.Core/issues/36 · Exploit
• https://t.me/cvenotify/97619 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2023-49958 · Nota de Segurança
• https://t.me/cvenotify/62698 · Publicação no Telegram
• https://twitter.com/CVEnew/status/1732751706516029607 · Publicação no Twitter
• https://osv.dev/vulnerability/CVE-2023-49958 · Aviso do Fabricante
• https://twitter.com/VulmonFeeds/status/1732784835427471817 · Publicação no Twitter