Arbitrary File Upload Vulnerability in Iocharger Firmware for AC Models

CVE-2024-43662

What is CVE-2024-43662?

The Iocharger firmware for AC models prior to version 24120701 contains a vulnerability that allows arbitrary file uploads to /tmp/upload/ or /tmp/ by utilizing specific CGI binaries. This issue arises because the file upload interface is primarily accessible to the iocadmin user. An attacker must have low-level access to a user account to exploit this flaw or convince a valid user to upload a file deliberately. While the attacker can upload files, they cannot influence the integrity of device operations without recognition of further vulnerabilities. This underscores the need for ongoing vigilance in firmware security measures, especially in devices such as electric vehicle chargers that may handle significant power loads.

References