Command Injection Vulnerability in Iocharger Firmware for AC Model Chargers

CVE-2024-43657

What is CVE-2024-43657?

A vulnerability exists in Iocharger firmware for AC model chargers prior to version 24120701, allowing command injection that could give an attacker root access to the device. This flaw can be exploited by an individual with low privileges who can access the action.exe CGI binary and upload a malicious firmware file. Once compromised, the attacker can gain complete control over the charging station, including the ability to add, modify, or delete files and services. This poses potential risks not only to device integrity but also to network security, as exploited devices might allow access to otherwise secure networks.

References