Command Injection Vulnerability in Iocharger Firmware for AC Models

CVE-2024-43654

Summary

The Iocharger AC EV charger firmware contains a command injection vulnerability that allows attackers with low privilege accounts to execute arbitrary commands as root. This vulnerability affects all AC models running firmware versions prior to 25010801. Attackers may exploit this weakness by crafting specific HTTP requests that leverage improper neutralization of special elements. Once exploited, they gain full control over the charging station, enabling them to add, modify, or delete files and services at will. This poses not only security risks but also potential safety hazards due to the nature of the device handling significant power.

References