CVE-2024-43648
Severity CVSS v4.0:
CRITICAL
Type:
CWE-78
OS Command Injections
Publication date:
09/01/2025
Last modified:
09/01/2025
Description
Command injection in the parameter of a .exe request leads to remote code execution as the root user.<br />
<br />
This issue affects Iocharger firmware for AC models before version 24120701.<br />
<br />
Likelihood: Moderate – This action is not a common place for command injection vulnerabilities to occur. Thus, an attacker will likely only be able to find this vulnerability by reverse-engineering the firmware or trying it on all fields. The attacker will also need a (low privilege) account to gain access to the binary, or convince a user with such access to execute a payload.<br />
<br />
Impact: Critical – The attacker has full control over the charging station as the root user, and can arbitrarily add, modify and delete files and services.<br />
<br />
CVSS clarification. The attack can be executed over any network connection the station is listening to and serves the web interface (AV:N), and there are no additional security measure sin place that need to be circumvented (AC:L), the attack does not rely on preconditions (AT:N). The attack does require authentication, but the level of authentication is irrelevant (PR:L), it does not require user interaction (UI:N). If is a full system compromise, potentially fully compromising confidentiality, integrity and availability of the devicer (VC:H/VI:H/VA:H). A compromised charger can be used to "pivot" onto networks that should otherwise be closed, cause a low confidentiality and interity impact on subsequent systems. (SC:L/SI:L/SA:H). Because this device is an EV charger handing significant amounts of power, we suspect this vulnerability can have a safety impact (S:P). The attack can be automated (AU:Y).
Impact
Base Score 4.0
9.30
Severity 4.0
CRITICAL
Base Score 3.x
8.80
Severity 3.x
HIGH