PT-2024-8066 · Phoenix Contact · Charx Sec-3100

Chris Anastasio + 1 · Published 2024-02-02 · Updated 2025-01-24 · CVE-2024-25998

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

The OCPP Service is affected by a command injection issue due to improper input validation, allowing an unauthenticated remote attacker to perform command injection with limited privileges. An exploit is available for this issue, with links to the exploit code provided at https://t.co/BZBA0cBOqQ and https://t.co/8lB6fukqj1. The specific software and versions affected are not specified, however, it is mentioned that the issue affects the OCPP Service. #OCPP #commandinjection #infosec #cybersecurityawareness #cybersecurity #hacker #infosecurity

Fix

RCE

Command Injection

Weakness Enumeration

CWE-20

CWE-77

Related Identifiers

BDU:2024-09587

CVE-2024-25998

ZDI-24-864

Affected Products

Charx Sec-3100

References · 10

• https://bdu.fstec.ru/vul/2024-09587 · Security Note
• https://zerodayinitiative.com/advisories/ZDI-24-864 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2024-25998 · Security Note
• https://osv.dev/vulnerability/CVE-2024-25998 · Vendor Advisory
• https://cert.vde.com/en/advisories/VDE-2024-011 · Note
• https://zerodayinitiative.com/advisories/ZDI-CAN-23320 · Note
• https://twitter.com/cracbot/status/1767989690232111426 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1767502171501728005 · Twitter Post
• https://t.me/cvenotify/108453 · Telegram Post
• https://twitter.com/CVEnew/status/1767470014783771092 · Twitter Post