PT-2023-31424 · Dalmann · Ocpp.Core

Gaetano Coppoletta · Published 2023-12-07 · Updated 2024-10-09 · CVE-2023-49958

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Dalmann OCPP.Core versions 1.2.0 and earlier

Description An issue was discovered in Dalmann OCPP.Core for OCPP (Open Charge Point Protocol) for electric vehicles. The server processes mishandle StartTransaction messages containing additional, arbitrary properties, or duplicate properties. The last occurrence of a duplicate property is accepted. This could be exploited to alter transaction records or impact system integrity.

Recommendations For versions 1.2.0 and earlier, as a temporary workaround, consider restricting the handling of StartTransaction messages to prevent the acceptance of additional or duplicate properties until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2023-49958

Affected Products

Ocpp.Core

References · 7

• 🔥 https://github.com/dallmann-consulting/OCPP.Core/issues/36 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2023-49958 · Security Note
• https://osv.dev/vulnerability/CVE-2023-49958 · Vendor Advisory
• https://t.me/cvenotify/97619 · Telegram Post
• https://t.me/cvenotify/62698 · Telegram Post
• https://twitter.com/CVEnew/status/1732751706516029607 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1732784835427471817 · Twitter Post