CVE-2024-43660
Severity CVSS v4.0:
HIGH
Type:
Unavailable / Other
Publication date:
09/01/2025
Last modified:
09/01/2025
Description
The CGI script .sh can be used to download any file on the filesystem.<br />
<br />
This issue affects Iocharger firmware for AC model chargers beforeversion 24120701.<br />
<br />
Likelihood: High, but credentials required.<br />
<br />
Impact: Critical – The script can be used to download any file on the filesystem, including sensitive files such as /etc/shadow, the CGI script source code or binaries and configuration files.<br />
<br />
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/S:P/AU:Y<br />
CVSS clarification. The attack can be executed over any network connection the station is listening to and serves the web interface (AV:N), and there are no additional security measure sin place that need to be circumvented (AC:L), the attack does not rely on preconditions (AT:N). The attack does require authentication, but the level of authentication is irrelevant (PR:L), it does not require user interaction (UI:N). The confidentiality of all files of the devicd can be compromised (VC:H/VI:N/VA:N). There is no impact on subsequent systems. (SC:N/SI:N/SA:N). While this device is an EV charger handing significant amounts of power, this attack in isolation does not have a safety impact. The attack can be automated (AU:Y).
Impact
Base Score 4.0
7.10
Severity 4.0
HIGH
Base Score 3.x
7.50
Severity 3.x
HIGH