PT-2025-2651 · Iocharger · Iocharger
Frank Breedijk
+2
·
Published
2025-01-09
·
Updated
2025-01-09
·
CVE-2024-43650
CVSS v4.0
9.3
Critical
| Vector | AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:P/AU:Y/R:X/V:X/RE:X/U:X |
Name of the Vulnerable Software and Affected Versions
Iocharger firmware for AC models versions prior to 24120701
Description
The issue is related to an improper neutralization of special elements used in a command, also known as 'Command Injection', which allows OS Command Injection as root. This gives the attacker full control over the charging station, allowing them to add, modify, and delete files and services arbitrarily. The attack can be executed over any network connection serving the web interface and does not require user interaction. The likelihood of the attack is moderate, but the impact is critical, with potential safety implications due to the high power used by the EV charger.
Recommendations
For Iocharger firmware for AC models versions prior to 24120701:
Update to a version that includes the fix for this issue.
As a temporary workaround, consider restricting access to the vulnerable binary or limiting the privileges of the account that can access it.
Avoid using the vulnerable firmware until a patch is available.
Restrict access to the web interface to minimize the risk of exploitation.
Note: At the moment, there is no information about a newer version that contains a fix for this vulnerability, so the above recommendations are based on general best practices for mitigating the risk.
Fix
OS Command Injection
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Iocharger