Privilege Escalation Vulnerability in OCPP Agent Service
CVE-2024-25999

7.8HIGH

Key Information:

Vendor
Phoenix Contact
Status
Charx Sec-3000
Charx Sec-3050
Charx Sec-3100
Charx Sec-3150
Vendor
CVE Published:
12 March 2024

Summary

A vulnerability has been identified in the OCPP agent service provided by VDE Technologies, which allows an unauthenticated local attacker to exploit improper input validation. Through this oversight, attackers can escalate privileges, potentially gaining unauthorized access to sensitive functions and data. Organizations utilizing the OCPP agent service are encouraged to review their system configurations and implement necessary security measures to mitigate this risk.

Affected Version(s)

CHARX SEC-3000 0 <= 1.5.0

CHARX SEC-3050 0 <= 1.5.0

CHARX SEC-3100 0 <= 1.5.0

References

https://cert.vde.com/en/advisories/VDE-2024-011

CVSS V3.1

Score:
7.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Chris Anastasio
Fabius Watson
.
CVE-2024-25999 : Privilege Escalation Vulnerability in OCPP Agent Service | SecurityVulnerability.io