Vulnerability · Published Jan 9, 2025 · Assigned by DIVD
CVE-2024-43652Authenticated command injection in the <redacted> action leads to full remote code execution as root on the charging station
High 8.8
In plain English
A high-severity OS command injection in Iocharger firmware for AC chargers from Iocharger. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 2.0% (higher than 81% of all known vulnerabilities).
Official description
Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability allows OS Command Injection as root This issue affects Iocharger firmware for AC model chargers before version 24120701 Likelihood: Moderate – The <redacted> binary does not seem to be used by the web interface, so it might be more difficult to find. It seems to be largely the same binary as used by the Iocharger Pedestal charging station, however. The attacker will also need a (low privilege) account to gain access to the <redacted> binary, or convince a user with such access to execute a crafted HTTP request. Impact: Critical – The attacker has full control over the charging station as the root user, and can arbitrarily add, modify and delete files and services.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Iocharger | Iocharger firmware for AC chargers | 0 – before 24120701 |
Weakness: CWE-78, CWE-250 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
References
- https://csirt.divd.nl/DIVD-2024-00035/ third-party-advisory
- https://csirt.divd.nl/CVE-2024-43652/ third-party-advisory
- https://iocharger.com product