Command Injection Vulnerability in Iocharger AC Model Firmware

CVE-2024-43653

Summary

A severe command injection vulnerability exists in the Iocharger firmware for AC model chargers prior to version 24120701. This issues arises from improper neutralization of special elements used in commands, allowing an attacker to execute arbitrary OS commands with root privileges. Although the vulnerable binary may not be directly accessed via the web interface, a low privilege account is necessary for exploitation. Once compromised, an attacker can gain full control over the charging station, facilitating the modification, addition, or deletion of files and services. The potential safety risks, coupled with the capability for automated attacks, heighten the urgency of addressing this vulnerability effectively.

References