Command Injection Vulnerability Can Lead to Root Privileges
CVE-2024-28136

7.8HIGH

Key Information:

Vendor
Phoenix Contact
Status
Charx Sec-3000
Charx Sec-3050
Charx Sec-3100
Charx Sec-3150
Vendor
CVE Published:
14 May 2024

Summary

A command injection vulnerability in the OCPP Remote Service can be exploited by local attackers with low privileges. This security flaw arises from inadequate input validation processes, enabling attackers to execute arbitrary commands that can lead to root privilege escalation. Organizations using the OCPP Remote Service should implement necessary patches and review their input validation mechanisms to mitigate potential security risks associated with this vulnerability.

Affected Version(s)

CHARX SEC-3000 0 <= 1.5.1

CHARX SEC-3050 0 <= 1.5.1

CHARX SEC-3100 0 <= 1.5.1

References

https://cert.vde.com/en/advisories/VDE-2024-019

CVSS V3.1

Score:
7.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Trend Micro's Zero Day Initiative
@ByteInsight
.
CVE-2024-28136 : Command Injection Vulnerability Can Lead to Root Privileges | SecurityVulnerability.io