PT-2024-17176 · Unknown · Cph2 Echarge Firmware

Quentin Kaiser · Published 2024-11-24 · Updated 2024-12-03 · CVE-2024-11666

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions cph2 echarge firmware versions through 2.0.4

Description The issue affects devices that communicate with the eCharge cloud infrastructure over an insecure channel, as peer verification is disabled. This allows remote unauthenticated users, suitably positioned on the network between an EV charger controller and eCharge infrastructure, to execute arbitrary commands with elevated privileges on affected devices.

Recommendations For cph2 echarge firmware versions through 2.0.4, update to a version that addresses the peer verification issue to prevent remote attacks. As a temporary workaround, consider restricting network access to the eCharge cloud infrastructure to minimize the risk of exploitation. Restrict access to the affected devices to prevent remote unauthenticated users from executing arbitrary commands with elevated privileges.

Exploit

Fix

Insufficient Verification of Data Authenticity

Weakness Enumeration

CWE-345

Related Identifiers

CVE-2024-11666

Affected Products

Cph2 Echarge Firmware

References · 8

• 🔥 https://onekey.com/resource/critical-vulnerabilities-in-ev-charging-stations-analysis-of-echarge-controllers · Exploit
• https://osv.dev/vulnerability/CVE-2024-11666 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-11666 · Security Note
• https://twitter.com/CVEnew/status/1860818535536292223 · Twitter Post
• https://twitter.com/CveFindCom/status/1860821451458109714 · Twitter Post
• https://t.me/cvenotify/102477 · Telegram Post
• https://t.me/cvenotify/102896 · Telegram Post
• https://t.me/cvenotify/102480 · Telegram Post