PT-2022-12446 · Garo · Garo Wallbox

Delikely · Published 2022-03-21 · Updated 2022-03-28 · CVE-2021-45876

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions GARO Wallbox versions (affected versions not specified)

Description The issue concerns unauthenticated command injection in multiple versions of the software. Specifically, the url parameter of the downloadAndUpdate function module is vulnerable to command injection. This occurs because unfiltered user input is used to generate code that gets executed when downloading new firmware.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Command Injection

Weakness Enumeration

CWE-77

Related Identifiers

CVE-2021-45876

Affected Products

Garo Wallbox

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2021-45876 · Security Note
• https://osv.dev/vulnerability/CVE-2021-45876 · Vendor Advisory
• https://github.com/delikely/advisory/tree/main/GARO · Note