PT-2025-2656 · Iocharger · Iocharger
Frank Breedijk
+2
·
Published
2025-01-09
·
Updated
2025-01-09
·
CVE-2024-43655
CVSS v4.0
9.3
Critical
| Vector | AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:P/AU:Y/R:X/V:X/RE:X/U:X |
Name of the Vulnerable Software and Affected Versions
Iocharger firmware for AC model chargers versions prior to 24120701
Description
The issue is related to an improper neutralization of special elements used in a command, allowing OS command injection as root. This gives an attacker full control over the charging station, enabling them to add, modify, and delete files and services arbitrarily. The attack can be automated and has a potential safety impact due to the charger handling significant power. The likelihood of the attack is moderate, requiring the attacker to find the script name and have a low-privilege account or convince a user to execute a request. However, the impact is critical, leading to a fully compromised system.
Recommendations
For Iocharger firmware for AC model chargers versions prior to 24120701, update to version 24120701 or later to resolve the issue. As a temporary workaround, consider restricting access to the vulnerable script or disabling it until a patch is available. Avoid using any potentially vulnerable API endpoints or parameters that could lead to command injection. Ensure that all network interfaces serving the web UI are properly secured and monitored.
Fix
OS Command Injection
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Iocharger