PT-2025-2652 · Iocharger · Iocharger

Frank Breedijk + 2 · Published 2025-01-09 · Updated 2025-01-09 · CVE-2024-43651

Positive Technologies (AI Summary)

CVSS v4.0

9.3

Critical

Base vector

AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:P/AU:Y/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions Iocharger firmware for AC models versions prior to 241207101

Description The issue is related to an Improper Neutralization of Special Elements used in a Command, also known as a 'Command Injection' vulnerability, which allows OS Command Injection as root. This gives an attacker full control over the charging station, allowing them to arbitrarily add, modify, and delete files and services. The attack requires authentication but does not need special conditions or user interaction. The vulnerability can be automated and may have a potential safety impact due to the charger handling significant power.

Recommendations For Iocharger firmware for AC models versions prior to 241207101: Update to a version newer than 241207101 to resolve the issue. As a temporary workaround, consider restricting access to the vulnerable binary or limiting the privileges of accounts that can access it. Avoid using the vulnerable interface until the issue is resolved.

Fix

OS Command Injection

Weakness Enumeration

CWE-78

CWE-250

Related Identifiers

CVE-2024-43651

Affected Products

Iocharger

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2024-43651 · Security Note
• https://twitter.com/VulmonFeeds/status/1877371855725552055 · Twitter Post
• https://twitter.com/CVEnew/status/1877274664701145463 · Twitter Post
• https://iocharger.com · Note
• https://csirt.divd.nl/CVE-2024-43651 · Note
• https://t.me/cvedetector/14816 · Telegram Post
• https://csirt.divd.nl/DIVD-2024-00035 · Note
• https://twitter.com/CveFindCom/status/1877272511693427098 · Twitter Post