CVE-2024-43661

Severity CVSS v4.0:
HIGH
Type:
CWE-121 Stack-based Buffer Overflow
Publication date:
09/01/2025
Last modified:
09/01/2025

Description

The .so library, which is used by , is<br /> vulnerable to a buffer overflow in the code that handles the deletion<br /> of certificates. This buffer overflow can be triggered by providing a<br /> long file path to the action of the .exe CGI binary or<br /> to the .sh CGI script. This binary or script will write this<br /> file path to , which is then<br /> read by .so<br /> <br /> <br /> This issue affects Iocharger firmware for AC models before version 24120701.<br /> <br /> Likelihood: Moderate – An attacker will have to find this exploit by<br /> either obtaining the binaries involved in this vulnerability, or by trial<br /> and error. Furthermore, the attacker will need a (low privilege)<br /> account to gain access to the .exe CGI binary or .sh<br /> script to trigger the vulnerability, or convince a user with such access<br /> send an HTTP request that triggers it.<br /> <br /> <br /> Impact: High – The process, which we assume is<br /> responsible for OCPP communication, will keep crashing after<br /> performing the exploit. This happens because the buffer overflow<br /> causes the process to segfault before<br /> is removed. This means that,<br /> even though is automatically restarted, it will crash<br /> again as soon as it tries to parse the text file.<br /> <br /> CVSS clarification. The attack can be executed over any network connection the station is listening to and serves the web interface (AV:N), and there are no additional security measure sin place that need to be circumvented (AC:L), the attack does not rely on preconditions (AT:N). The attack does require authentication, but the level of authentication is irrelevant (PR:L), it does not require user interaction (UI:N). The attack leads to reducred availability of the device (VC:N/VI:N/VA:H). THere is not impact on subsequent systems. (SC:N/SI:N/SA:N). Alltough this device is an EV charger handing significant amounts of power, we do not forsee a safety impact. The attack can be automated (AU:Y). Because the DoS condition is written to disk persistantly, it cannot be recovered by the user (R:I).