Harm Van Den Brink

Name of the Vulnerable Software and Affected Versions: Mennekes Smart / Premium Chargingpoints (affected versions not specified) Description: The issue concerns the authenticated firmware update capability of the Mennekes Smart / Premium Chargingpoints, which can be exploited for command execution. This is due to the improper neutralization of OS commands when certain fields are passed to the underlying OS. Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: Mennekes Smart / Premium Chargingpoints (affected versions not specified) Description: The authenticated time setting capability of the firmware for Mennekes Smart / Premium Chargingpoints can be abused for command execution because OS commands are improperly neutralized when certain fields are passed to the underlying OS. Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: Mennekes Smart / Premium Chargingpoints (affected versions not specified) Description: The issue concerns the improper neutralization of OS commands in certain fields passed to the underlying OS, allowing for command execution through the authenticated SCU firmware command. This is due to the improper sanitization of OS commands in SCU firmware commands. Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: Mennekes Smart / Premium Chargingpoints (affected versions not specified) Description: The issue concerns the "ReadFile" endpoint of the firmware, which can be exploited to read arbitrary files from the underlying operating system. This allows unauthorized access to sensitive information. Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: Mennekes Smart / Premium Chargingpoints (affected versions not specified) Description: The web configuration interface of the firmware for Mennekes Smart / Premium Chargingpoints has a issue where many fields can be exploited to execute arbitrary SQL commands due to insufficient neutralization of input values. Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Iocharger firmware for AC models versions prior to 24120701 **Description** The issue is related to command injection in a specific parameter of a .exe request, leading to remote code execution as the root user. This allows an attacker to have full control over the charging station, arbitrarily adding, modifying, and deleting files and services. The attack can be executed over any network connection the station is listening to and serves the web interface. A compromised charger can be used to "pivot" onto networks that should otherwise be closed, causing a low confidentiality and integrity impact on subsequent systems. The vulnerability can potentially have a safety impact due to the device handling significant amounts of power. **Recommendations** For Iocharger firmware for AC models versions prior to 24120701, update to version 24120701 or later to resolve the issue. As a temporary workaround, consider restricting access to the vulnerable binary or disabling the affected parameter to minimize the risk of exploitation. Avoid using the vulnerable parameter in the affected API endpoint until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** Iocharger firmware for AC models versions prior to 24120701 **Description** The issue is related to authenticated command injection in the filename of a certain .exe request, leading to remote code execution as the root user. This allows an attacker to have full control over the charging station, arbitrarily adding, modifying, and deleting files and services. The attack can be performed over any network connection serving the web interface and does not require additional mitigating measures or user interaction. The impact is critical, with potential safety implications due to the significant power of the electric vehicle chargers. **Recommendations** For Iocharger firmware for AC models versions prior to 24120701, update to a version 24120701 or later to resolve the issue. As a temporary workaround, consider restricting access to the vulnerable .exe request to minimize the risk of exploitation. Avoid using the vulnerable filename parameter in the affected API endpoint until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** Iocharger firmware for AC models versions prior to 24120701 **Description** The issue is related to an improper neutralization of special elements used in a command, also known as 'Command Injection', which allows OS Command Injection as root. This gives the attacker full control over the charging station, allowing them to add, modify, and delete files and services arbitrarily. The attack can be executed over any network connection serving the web interface and does not require user interaction. The likelihood of the attack is moderate, but the impact is critical, with potential safety implications due to the high power used by the EV charger. **Recommendations** For Iocharger firmware for AC models versions prior to 24120701: Update to a version that includes the fix for this issue. As a temporary workaround, consider restricting access to the vulnerable binary or limiting the privileges of the account that can access it. Avoid using the vulnerable firmware until a patch is available. Restrict access to the web interface to minimize the risk of exploitation. Note: At the moment, there is no information about a newer version that contains a fix for this vulnerability, so the above recommendations are based on general best practices for mitigating the risk.

**Name of the Vulnerable Software and Affected Versions** Iocharger firmware for AC models versions prior to 241207101 **Description** The issue is related to an Improper Neutralization of Special Elements used in a Command, also known as a 'Command Injection' vulnerability, which allows OS Command Injection as root. This gives an attacker full control over the charging station, allowing them to arbitrarily add, modify, and delete files and services. The attack requires authentication but does not need special conditions or user interaction. The vulnerability can be automated and may have a potential safety impact due to the charger handling significant power. **Recommendations** For Iocharger firmware for AC models versions prior to 241207101: Update to a version newer than 241207101 to resolve the issue. As a temporary workaround, consider restricting access to the vulnerable binary or limiting the privileges of accounts that can access it. Avoid using the vulnerable interface until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** Iocharger firmware for AC model chargers versions prior to 24120701 **Description** The issue is related to an Improper Neutralization of Special Elements used in a Command, also known as a Command Injection vulnerability. This allows an attacker to perform OS Command Injection as the root user, giving them full control over the charging station. The attacker needs a low-privilege account to access the vulnerable binary or convince a user with such access to execute a crafted HTTP request. The impact is critical, as the attacker can arbitrarily add, modify, and delete files and services. **Recommendations** For Iocharger firmware for AC model chargers versions prior to 24120701, update to version 24120701 or later to resolve the issue. As a temporary workaround, consider restricting access to the vulnerable binary to minimize the risk of exploitation. Additionally, avoid using the vulnerable interface until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** Iocharger firmware for AC model chargers versions prior to 24120701 **Description** The issue is related to an improper neutralization of special elements used in a command, allowing OS command injection as root. This gives an attacker full control over the charging station, enabling them to add, modify, and delete files and services arbitrarily. The attack can be automated and has a potential safety impact due to the charger handling significant power. The likelihood of the attack is moderate, requiring a low-privilege account or convincing a user with such access to execute a crafted HTTP request. **Recommendations** For Iocharger firmware for AC model chargers versions prior to 24120701, update to a version 24120701 or later to resolve the issue. As a temporary workaround, consider restricting access to the vulnerable binary or disabling its use until a patch is available. Avoid using the vulnerable interface until the issue is resolved. At the moment, there is no other information about additional mitigation measures.

**Name of the Vulnerable Software and Affected Versions** Iocharger firmware for AC models versions prior to 25010801 **Description** The issue is related to an improper neutralization of special elements used in a command, allowing OS command injection as root. This gives an attacker full control over the charging station, enabling them to add, modify, and delete files and services arbitrarily. The attack can be automated and may have a potential safety impact due to the charger handling significant power. The likelihood of the attack is moderate, requiring a low-privilege account or convincing a user with such access to execute a crafted HTTP request. **Recommendations** For versions prior to 25010801, update the firmware to a version that includes the fix for this issue. As a temporary workaround, consider restricting access to the vulnerable binary or disabling any unnecessary features that could be used to exploit this issue. Avoid using the affected firmware until a patch is available. At the moment, there is no information about additional mitigation measures.

**Name of the Vulnerable Software and Affected Versions** Iocharger firmware for AC model chargers versions prior to 24120701 **Description** The issue is related to an improper neutralization of special elements used in a command, allowing OS command injection as root. This gives an attacker full control over the charging station, enabling them to add, modify, and delete files and services arbitrarily. The attack can be automated and has a potential safety impact due to the charger handling significant power. The likelihood of the attack is moderate, requiring the attacker to find the script name and have a low-privilege account or convince a user to execute a request. However, the impact is critical, leading to a fully compromised system. **Recommendations** For Iocharger firmware for AC model chargers versions prior to 24120701, update to version 24120701 or later to resolve the issue. As a temporary workaround, consider restricting access to the vulnerable script or disabling it until a patch is available. Avoid using any potentially vulnerable API endpoints or parameters that could lead to command injection. Ensure that all network interfaces serving the web UI are properly secured and monitored.

**Name of the Vulnerable Software and Affected Versions** Iocharger firmware for AC model chargers versions prior to 24120701 **Description** The issue is related to improper neutralization of special elements used in a command, allowing OS command injection as root. This gives an attacker full control over the charging station, enabling them to add, modify, and delete files and services arbitrarily. The attack can be automated and may have a potential safety impact due to the charger handling significant power. The likelihood of the attack is moderate, requiring an attacker to identify the file structure of a specific directory and modify a backup to add a new CGI script, or convince a user with access to upload a modified backup file. **Recommendations** For Iocharger firmware for AC model chargers versions prior to 24120701: Update to a version newer than 24120701 to resolve the issue. As a temporary workaround, consider restricting access to the web interface and limiting user accounts that can restore settings backups to minimize the risk of exploitation. Avoid using the affected firmware until a patch is available. At the moment, there is no information about additional mitigation measures.

**Name of the Vulnerable Software and Affected Versions** Iocharger firmware for AC model chargers versions prior to 24120701 **Description** The issue is related to an improper neutralization of special elements used in a command, allowing OS command injection as root. This gives an attacker full control over the charging station, enabling them to add, modify, and delete files and services arbitrarily. The attack can be automated and has a potential safety impact due to the charger handling significant power. Any network interface serving the web UI is vulnerable, and the attack requires low-level authentication but no user interaction. **Recommendations** For Iocharger firmware for AC model chargers versions prior to 24120701: Update to version 24120701 or later to resolve the issue. As a temporary workaround, consider restricting access to the action.exe CGI binary to minimize the risk of exploitation. Avoid using the vulnerable firmware until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** Iocharger Home firmware for AC model versions prior to 25010801 **Description** The issue is related to a patch traversal vulnerability, which allows for external control of file name or path, enabling the deletion of arbitrary files. This can severely impact the integrity and availability of the charging station, as it can be used to delete any file, including binaries necessary for the station's operation. The attack requires authentication but can be automated, and it compromises the integrity and availability of the device. **Recommendations** For Iocharger Home firmware for AC model versions prior to 25010801: Update to a version newer than 25010801 to resolve the issue. As a temporary workaround, consider restricting access to the web interface to minimize the risk of exploitation. Avoid using the vulnerable firmware until a patch is available. At the moment, there is no information about additional mitigation measures.

**Name of the Vulnerable Software and Affected Versions** Iocharger firmware for AC models versions prior to 25010801 **Description** The issue allows an attacker to obtain default credentials that are the same across all Iocharger AC model EV chargers by accessing a file after gaining access to the firmware of a charging station. The estimated number of potentially affected devices is not provided. The impact of this issue is critical, as it could allow an attacker to log into many Iocharger charging stations and execute arbitrary commands via the System → Custom page. The attack requires high privileges and no user interaction, and it can be automated. **Recommendations** For Iocharger firmware for AC models versions prior to 25010801, update the firmware to version 25010801 or later and change the password to prevent unauthorized access. As a temporary workaround, consider restricting access to the System → Custom page until the firmware is updated. Additionally, it is recommended to change the password on older models to ensure security.

**Name of the Vulnerable Software and Affected Versions** Iocharger firmware for AC model chargers versions prior to 24120701 **Description** The issue allows an attacker to download any file on the filesystem using the CGI script. This has a critical impact, as sensitive files such as /etc/shadow, the CGI script source code, or binaries and configuration files can be accessed. The attack can be executed over any network connection and requires authentication, but the level of authentication is irrelevant. The confidentiality of all files on the device can be compromised. While this device handles significant amounts of power, the attack in isolation does not have a safety impact. The attack can be automated. **Recommendations** For Iocharger firmware for AC model chargers versions prior to 24120701, update to version 24120701 or later to resolve the issue. As a temporary workaround, consider restricting access to the CGI script to minimize the risk of exploitation. Avoid using the CGI script until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** Iocharger firmware for AC models versions prior to 24120701 **Description** The issue is related to a buffer overflow in the code that handles the deletion of certificates. This buffer overflow can be triggered by providing a long file path to the action of the CGI binary or to the CGI script. The binary or script will write this file path to a location that is then read by the .so library. The estimated likelihood of this issue is moderate, as an attacker would need to find this exploit either by obtaining the binaries involved or by trial and error, and also require a low-privilege account to gain access to the CGI binary or script. The impact is high, as the process responsible for OCPP communication will keep crashing after performing the exploit, causing a denial of service. **Recommendations** For Iocharger firmware for AC models versions prior to 24120701: As a temporary workaround, consider restricting access to the CGI binary or script to minimize the risk of exploitation. Avoid using long file paths in the action of the CGI binary or script until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Iocharger firmware for AC models versions prior to 24120701 **Description** The issue allows attackers to upload arbitrary files to /tmp/upload/ or /tmp/ as any user, although the file upload interface is only visible to the iocadmin user. The attack requires knowledge of the CGI binary and a low-privilege account to access the binary and upload files. The impact is low, as the attacker cannot access or use the uploaded files without other vulnerabilities. The attack can be executed over any network connection serving the web interface and can be automated. **Recommendations** For Iocharger firmware for AC models versions prior to 24120701: As a temporary workaround, consider restricting access to the CGI binary to minimize the risk of exploitation. Avoid using the file upload feature until the issue is resolved. Update to a version later than 24120701 to fully resolve the issue.