OS Command Injection Vulnerabilities in Device Firmware by Vendor A
CVE-2025-27804

6.5MEDIUM

Key Information:

Vendor

Echarge Hardy Barth

Status
Cph2 / Cpp2 Charging Stations
Vendor
CVE Published:
21 May 2025

What is CVE-2025-27804?

Multiple OS command injection issues have been identified in the device firmware's /var/salia/mqtt.php script. By sending specifically crafted messages to designated MQTT topics, it is possible to execute arbitrary OS commands with root permissions. This vulnerability underscores serious security risks, potentially leading to unauthorized access and manipulation of the device's operating system.

Affected Version(s)

cPH2 / cPP2 charging stations <=2.2.0

References

https://r.sec-consult.com/echarge
third-party-advisory

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Stefan Viehböck | SEC Consult Vulnerability Lab
.