Authenticated Command Injection in Iocharger Firmware for AC Models

CVE-2024-43649

What is CVE-2024-43649?

This vulnerability involves an authenticated command injection in the filename of a request sent to Iocharger firmware for AC models prior to version 24120701. An attacker with low-level privileges can exploit this flaw, leading to remote code execution with root user access. This gives the attacker full control over the charging station, enabling them to arbitrarily add, modify, or delete files and services. Due to the nature of the attack, which can be executed over any network connection serving the web interface, it poses significant security risks, including potential safety hazards linked to the compromised charging infrastructure.

References