Default Credential Exposure in Iocharger AC Model EV Chargers

CVE-2024-43659

What is CVE-2024-43659?

A significant vulnerability exists in Iocharger AC model EV chargers that allows an attacker to gain access to default credentials stored in firmware. These credentials are uniform across all units, making a large number of chargers susceptible to unauthorized access, especially those running firmware versions prior to 25010801. Attackers may exploit a code execution or file inclusion vulnerability to access sensitive files, enabling them to take control of the charging stations and perform malicious actions. While the issue has been partially mitigated by enforcing password changes on first login, many devices may still retain the default password, allowing for potential exploitation. Immediate upgrading of firmware and password management is strongly recommended to enhance security and protect against unauthorized access.

References