PT-2025-10760 · Mennekes · Mennekes Smart / Premium Chargingpoints

Frank Breedijk + 2 · Published 2025-03-11 · Updated 2025-03-11 · CVE-2025-22368

Positive Technologies (AI Summary)

CVSS v4.0

8.7

High

Base vector

AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:L/SI:N/SA:N/S:N/AU:Y

Name of the Vulnerable Software and Affected Versions: Mennekes Smart / Premium Chargingpoints (affected versions not specified)

Description: The issue concerns the improper neutralization of OS commands in certain fields passed to the underlying OS, allowing for command execution through the authenticated SCU firmware command. This is due to the improper sanitization of OS commands in SCU firmware commands.

Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

OS Command Injection

Weakness Enumeration

CWE-78

CWE-250

Related Identifiers

CVE-2025-22368

Affected Products

Mennekes Smart / Premium Chargingpoints

References · 6

• https://csirt.divd.nl/DIVD-2025-00003 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-22368 · Security Note
• https://twitter.com/CVEnew/status/1899457887459762423 · Twitter Post
• https://twitter.com/CveFindCom/status/1899460766241014112 · Twitter Post
• https://csirt.divd.nl/CVE-2025-22368 · Note
• https://mennekes.nl/fileadmin/MEN-Deutschland/emobility/04_software/06_smart_premium/Release_Notes_for_2.15_06.03.2025.pdf · Note