PT-2025-16397 · Steve · Steve

Published 2025-04-15 · Updated 2025-04-15 · CVE-2024-44843

Positive Technologies (AI Summary)

CVSS v3.1

5.9

Medium

Base vector

AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:L/A:L

Name of the Vulnerable Software and Affected Versions SteVe version 3.7.1

Description The issue lies in the web socket handshake process, allowing attackers to bypass authentication and execute arbitrary commands by supplying crafted OCPP requests.

Recommendations For SteVe version 3.7.1, consider disabling the web socket handshake process until a patch is available to prevent attackers from bypassing authentication. Restrict access to the OCPP request handling module to minimize the risk of exploitation. Avoid using the vulnerable web socket handshake functionality in the affected version until the issue is resolved.

Exploit

Fix

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

CVE-2024-44843

Affected Products

Steve

References · 6

• 🔥 https://gist.github.com/Badranh/94359664799db6d4709871f0c353f476 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2024-44843 · Security Note
• https://osv.dev/vulnerability/CVE-2024-44843 · Vendor Advisory
• https://github.com/steve-community/steve/issues/1546 · Note
• https://github.com/steve-community/steve/blob/master/src/main/java/de/rwth/idsg/steve/ocpp/ws/OcppWebSocketHandshakeHandler.java · Note
• https://twitter.com/CVEnew/status/1912253265321787730 · Twitter Post