Frank Breedijk

**Name of the Vulnerable Software and Affected Versions** Growatt cloud service (affected versions not specified) **Description** An incorrect authorisation check exists in the 'plant transfer' function. This allows a malicious attacker with a valid account to transfer any plant into their account. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** SunGrow's back end users system iSolarCloud (affected versions not specified) **Description** The issue concerns the MQTT service used by iSolarCloud to transport data from connected devices to the user's web browser. The MQTT server lacks sufficient restrictions on topic subscriptions, allowing unauthorized access to data. Although the data is encrypted and MQTT credentials are obtained through an API call, an attacker can extract these credentials and the decryption key from the browser. This enables the attacker to subscribe to any topic, including the '#' topic, which would allow them to receive all messages from all connected devices. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: SicommNet BASEC (SaaS Service) versions prior to the fixed version, which is not specified. Description: The issue is related to an SQL Injection vulnerability in the login page of SicommNet BASEC, allowing an unauthenticated remote attacker to bypass authentication and execute arbitrary SQL commands. This vulnerability has been present in the solution at least since December 14, 2021, and likely before that. Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: SicommNet BASEC versions from 14 Dec 2021 Description: The issue is related to insufficiently protected credentials, allowing password recovery. Passwords are stored in plain text using reversible encryption, which enables an attacker with sufficient privileges to easily extract plain text passwords. Recommendations: For versions from 14 Dec 2021, consider restricting access to password recovery features until a proper fix is implemented. As a temporary workaround, limit privileges to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: SicommNet BASEC versions from 14 Dec 2021 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting (XSS). This allows for Reflected XSS, XSS Through HTTP Query Strings, Rendering of Arbitrary HTML, and alteration of CSS Styles. Recommendations: For versions from 14 Dec 2021, as a temporary workaround, consider restricting user input in web page generation to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: Mennekes Smart / Premium Chargingpoints (affected versions not specified) Description: The web configuration interface of the firmware for Mennekes Smart / Premium Chargingpoints has a issue where many fields can be exploited to execute arbitrary SQL commands due to insufficient neutralization of input values. Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: Mennekes Smart / Premium Chargingpoints (affected versions not specified) Description: The issue concerns the authenticated firmware update capability of the Mennekes Smart / Premium Chargingpoints, which can be exploited for command execution. This is due to the improper neutralization of OS commands when certain fields are passed to the underlying OS. Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: Mennekes Smart / Premium Chargingpoints (affected versions not specified) Description: The authenticated time setting capability of the firmware for Mennekes Smart / Premium Chargingpoints can be abused for command execution because OS commands are improperly neutralized when certain fields are passed to the underlying OS. Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: Mennekes Smart / Premium Chargingpoints (affected versions not specified) Description: The issue concerns the improper neutralization of OS commands in certain fields passed to the underlying OS, allowing for command execution through the authenticated SCU firmware command. This is due to the improper sanitization of OS commands in SCU firmware commands. Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: Mennekes Smart / Premium Chargingpoints (affected versions not specified) Description: The issue concerns the "ReadFile" endpoint of the firmware, which can be exploited to read arbitrary files from the underlying operating system. This allows unauthorized access to sensitive information. Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Iocharger firmware for AC models versions prior to 24120701 **Description** The issue is related to an improper neutralization of special elements used in a command, also known as 'Command Injection', which allows OS Command Injection as root. This gives the attacker full control over the charging station, allowing them to add, modify, and delete files and services arbitrarily. The attack can be executed over any network connection serving the web interface and does not require user interaction. The likelihood of the attack is moderate, but the impact is critical, with potential safety implications due to the high power used by the EV charger. **Recommendations** For Iocharger firmware for AC models versions prior to 24120701: Update to a version that includes the fix for this issue. As a temporary workaround, consider restricting access to the vulnerable binary or limiting the privileges of the account that can access it. Avoid using the vulnerable firmware until a patch is available. Restrict access to the web interface to minimize the risk of exploitation. Note: At the moment, there is no information about a newer version that contains a fix for this vulnerability, so the above recommendations are based on general best practices for mitigating the risk.

**Name of the Vulnerable Software and Affected Versions** Iocharger firmware for AC models versions prior to 241207101 **Description** The issue is related to an Improper Neutralization of Special Elements used in a Command, also known as a 'Command Injection' vulnerability, which allows OS Command Injection as root. This gives an attacker full control over the charging station, allowing them to arbitrarily add, modify, and delete files and services. The attack requires authentication but does not need special conditions or user interaction. The vulnerability can be automated and may have a potential safety impact due to the charger handling significant power. **Recommendations** For Iocharger firmware for AC models versions prior to 241207101: Update to a version newer than 241207101 to resolve the issue. As a temporary workaround, consider restricting access to the vulnerable binary or limiting the privileges of accounts that can access it. Avoid using the vulnerable interface until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** Iocharger firmware for AC models versions prior to 24120701 **Description** The issue is related to authenticated command injection in the filename of a certain .exe request, leading to remote code execution as the root user. This allows an attacker to have full control over the charging station, arbitrarily adding, modifying, and deleting files and services. The attack can be performed over any network connection serving the web interface and does not require additional mitigating measures or user interaction. The impact is critical, with potential safety implications due to the significant power of the electric vehicle chargers. **Recommendations** For Iocharger firmware for AC models versions prior to 24120701, update to a version 24120701 or later to resolve the issue. As a temporary workaround, consider restricting access to the vulnerable .exe request to minimize the risk of exploitation. Avoid using the vulnerable filename parameter in the affected API endpoint until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** Iocharger firmware for AC model chargers versions prior to 24120701 **Description** The issue is related to an improper neutralization of special elements used in a command, allowing OS command injection as root. This gives an attacker full control over the charging station, enabling them to add, modify, and delete files and services arbitrarily. The attack can be automated and has a potential safety impact due to the charger handling significant power. Any network interface serving the web UI is vulnerable, and the attack requires low-level authentication but no user interaction. **Recommendations** For Iocharger firmware for AC model chargers versions prior to 24120701: Update to version 24120701 or later to resolve the issue. As a temporary workaround, consider restricting access to the action.exe CGI binary to minimize the risk of exploitation. Avoid using the vulnerable firmware until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** Iocharger firmware for AC models versions prior to 25010801 **Description** The issue is related to an improper neutralization of special elements used in a command, allowing OS command injection as root. This gives an attacker full control over the charging station, enabling them to add, modify, and delete files and services arbitrarily. The attack can be automated and may have a potential safety impact due to the charger handling significant power. The likelihood of the attack is moderate, requiring a low-privilege account or convincing a user with such access to execute a crafted HTTP request. **Recommendations** For versions prior to 25010801, update the firmware to a version that includes the fix for this issue. As a temporary workaround, consider restricting access to the vulnerable binary or disabling any unnecessary features that could be used to exploit this issue. Avoid using the affected firmware until a patch is available. At the moment, there is no information about additional mitigation measures.

**Name of the Vulnerable Software and Affected Versions** Iocharger firmware for AC model chargers versions prior to 24120701 **Description** The issue is related to an improper neutralization of special elements used in a command, allowing OS command injection as root. This gives an attacker full control over the charging station, enabling them to add, modify, and delete files and services arbitrarily. The attack can be automated and has a potential safety impact due to the charger handling significant power. The likelihood of the attack is moderate, requiring a low-privilege account or convincing a user with such access to execute a crafted HTTP request. **Recommendations** For Iocharger firmware for AC model chargers versions prior to 24120701, update to a version 24120701 or later to resolve the issue. As a temporary workaround, consider restricting access to the vulnerable binary or disabling its use until a patch is available. Avoid using the vulnerable interface until the issue is resolved. At the moment, there is no other information about additional mitigation measures.

**Name of the Vulnerable Software and Affected Versions** Iocharger firmware for AC model chargers versions prior to 24120701 **Description** The issue is related to an improper neutralization of special elements used in a command, allowing OS command injection as root. This gives an attacker full control over the charging station, enabling them to add, modify, and delete files and services arbitrarily. The attack can be automated and has a potential safety impact due to the charger handling significant power. The likelihood of the attack is moderate, requiring the attacker to find the script name and have a low-privilege account or convince a user to execute a request. However, the impact is critical, leading to a fully compromised system. **Recommendations** For Iocharger firmware for AC model chargers versions prior to 24120701, update to version 24120701 or later to resolve the issue. As a temporary workaround, consider restricting access to the vulnerable script or disabling it until a patch is available. Avoid using any potentially vulnerable API endpoints or parameters that could lead to command injection. Ensure that all network interfaces serving the web UI are properly secured and monitored.

**Name of the Vulnerable Software and Affected Versions** Iocharger firmware for AC models versions prior to 24120701 **Description** The issue is related to command injection in a specific parameter of a .exe request, leading to remote code execution as the root user. This allows an attacker to have full control over the charging station, arbitrarily adding, modifying, and deleting files and services. The attack can be executed over any network connection the station is listening to and serves the web interface. A compromised charger can be used to "pivot" onto networks that should otherwise be closed, causing a low confidentiality and integrity impact on subsequent systems. The vulnerability can potentially have a safety impact due to the device handling significant amounts of power. **Recommendations** For Iocharger firmware for AC models versions prior to 24120701, update to version 24120701 or later to resolve the issue. As a temporary workaround, consider restricting access to the vulnerable binary or disabling the affected parameter to minimize the risk of exploitation. Avoid using the vulnerable parameter in the affected API endpoint until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** Iocharger firmware for AC model chargers versions prior to 24120701 **Description** The issue is related to an Improper Neutralization of Special Elements used in a Command, also known as a Command Injection vulnerability. This allows an attacker to perform OS Command Injection as the root user, giving them full control over the charging station. The attacker needs a low-privilege account to access the vulnerable binary or convince a user with such access to execute a crafted HTTP request. The impact is critical, as the attacker can arbitrarily add, modify, and delete files and services. **Recommendations** For Iocharger firmware for AC model chargers versions prior to 24120701, update to version 24120701 or later to resolve the issue. As a temporary workaround, consider restricting access to the vulnerable binary to minimize the risk of exploitation. Additionally, avoid using the vulnerable interface until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** Iocharger firmware for AC model chargers versions prior to 24120701 **Description** The issue is related to improper neutralization of special elements used in a command, allowing OS command injection as root. This gives an attacker full control over the charging station, enabling them to add, modify, and delete files and services arbitrarily. The attack can be automated and may have a potential safety impact due to the charger handling significant power. The likelihood of the attack is moderate, requiring an attacker to identify the file structure of a specific directory and modify a backup to add a new CGI script, or convince a user with access to upload a modified backup file. **Recommendations** For Iocharger firmware for AC model chargers versions prior to 24120701: Update to a version newer than 24120701 to resolve the issue. As a temporary workaround, consider restricting access to the web interface and limiting user accounts that can restore settings backups to minimize the risk of exploitation. Avoid using the affected firmware until a patch is available. At the moment, there is no information about additional mitigation measures.