IIocharger

Products

Exploited and recent CVEs

• CVE-2024-43651 Critical 9.3 Authenticated command injection in the <redacted> action leads to full remote code execution as root on the charging station 1.8%
• CVE-2024-43658 High 7.2 Using the <redacted> action or <redacted>.sh script, arbitrary files and directories can be deleted using directory traversal. 0.6%
• CVE-2024-43654 High 8.8 Authenticated command injection in the <redacted> action leads to full remote code execution as root on the charging station 2.2%
• CVE-2024-43649 High 8.8 Authenticated command injection via <redacted>.exe <redacted> parameter 1.8%
• CVE-2024-43660 High 7.5 Arbitrary file download using <redacted>.sh 0.6%
• CVE-2024-43653 High 8.8 Authenticated command injection in the <redacted> action leads to full remote code execution as root on the charging station 2.2%
• CVE-2024-43661 Critical 9.8 Buffer overflow in <redacted>.so leads to DoS of OCPP service 0.5%
• CVE-2024-43652 High 8.8 Authenticated command injection in the <redacted> action leads to full remote code execution as root on the charging station 2.0%
• CVE-2024-43657 High 8.8 When uploading new firmware, a shell script inside a firmware file is executed during its processing. This can be used to craft a custom firmware file with a custom script with arbitrary code, which will then be executed on the charging station. 1.5%
• CVE-2024-43648 High 8.8 Authenticated command injection via <redacted>.exe <redacted> parameter 1.9%
• CVE-2024-43663 Critical 9.8 Buffer overflow vulnerabilities in CGI scripts lead to segfault 1.0%
• CVE-2024-43659 High 7.2 Plaintext default credentials in firmware 0.8%
• CVE-2024-43656 High 8.8 A backup can be manipulated and then restored to create arbitrary files inside the <redacted> directory. A CGI script can be added to the web directory this way, allowing for full remote code execution. 1.5%
• CVE-2024-43662 Medium 5.3 Authenticated arbitrary file upload to /tmp/ and /tmp/upload/ 0.6%
• CVE-2024-43650 Critical 9.3 Authenticated command injection in the <redacted> action leads to full remote code execution as root on the charging station 1.7%
• CVE-2024-43655 Critical 9.3 Any authenticated users can execute OS commands as root using the <redacted>.sh CGI script. 1.3%