PT-2024-37080 · Volkswagen Group Charging Gmbh Elli+2 · Id Charger Connect & Pro+2

Anna Breeva · Published 2024-06-06 · Updated 2024-06-11 · CVE-2024-5684

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: No specific software name or affected versions are mentioned in the provided descriptions.

Description: The issue is related to a faulty implementation of the JWT-library, which can be exploited by an attacker with access to the private network or local access to the Ethernet-Interface to bypass password authentication to the web configuration interface. This allows the attacker to have full access as a user would have, although without developer or admin rights. If the JWT-library implementation is wrongly configured to accept "none"-algorithms, the server will pass insecure JWT, enabling a local, unauthenticated attacker to bypass the authentication mechanism.

Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Insufficient Verification of Data Authenticity

Weakness Enumeration

CWE-345

Related Identifiers

CVE-2024-5684

Affected Products

Id Charger Connect & Pro

Id.Charger Connect Firmware

Id.Charger Pro Firmware

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2024-5684 · Security Note
• https://osv.dev/vulnerability/CVE-2024-5684 · Vendor Advisory
• https://twitter.com/VulmonFeeds/status/1798724410217816513 · Twitter Post
• https://twitter.com/CVEnew/status/1798705537569403075 · Twitter Post
• https://twitter.com/linuxpatch/status/1798718204015153187 · Twitter Post
• https://t.me/cvenotify/82175 · Telegram Post
• https://asrg.io/security-advisories/vulnerability-in-id-charger-connect-and-pro-from-volkswagen-group-charging-gmbh-elli-evbox-versions-spr3-2b-spr3-51-and-spr3-52 · Note