Frank Breedijk

A session hijack issue allows for remote code execution as the zammad user. Approximately 12,000 instances have been identified globally.

Improper privilege management allows a local zammad user to escalate privileges to root.

An incorrect authorisation check exists in the 'plant transfer' function. This allows a malicious attacker with a valid account to transfer any plant into their account.

The issue concerns the MQTT service used by iSolarCloud to transport data from connected devices to the user's web browser. The MQTT server lacks sufficient restrictions on topic subscriptions, allowing unauthorized access to data. Although the data is encrypted and MQTT credentials are obtained through an API call, an attacker can extract these credentials and the decryption key from the browser. This enables the attacker to subscribe to any topic, including the '#' topic, which would allow them to receive all messages from all connected devices.

Name of the Vulnerable Software and Affected Versions: SicommNet BASEC (SaaS Service) versions prior to the fixed version, which is not specified. Description: The issue is related to an SQL Injection vulnerability in the login page of SicommNet BASEC, allowing an unauthenticated remote attacker to bypass authentication and execute arbitrary SQL commands. This vulnerability has been present in the solution at least since December 14, 2021, and likely before that. Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: SicommNet BASEC versions from 14 Dec 2021 Description: The issue is related to insufficiently protected credentials, allowing password recovery. Passwords are stored in plain text using reversible encryption, which enables an attacker with sufficient privileges to easily extract plain text passwords. Recommendations: For versions from 14 Dec 2021, consider restricting access to password recovery features until a proper fix is implemented. As a temporary workaround, limit privileges to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: SicommNet BASEC versions from 14 Dec 2021 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting (XSS). This allows for Reflected XSS, XSS Through HTTP Query Strings, Rendering of Arbitrary HTML, and alteration of CSS Styles. Recommendations: For versions from 14 Dec 2021, as a temporary workaround, consider restricting user input in web page generation to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: Mennekes Smart / Premium Chargingpoints (affected versions not specified) Description: The web configuration interface of the firmware for Mennekes Smart / Premium Chargingpoints has a issue where many fields can be exploited to execute arbitrary SQL commands due to insufficient neutralization of input values. Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: Mennekes Smart / Premium Chargingpoints (affected versions not specified) Description: The issue concerns the authenticated firmware update capability of the Mennekes Smart / Premium Chargingpoints, which can be exploited for command execution. This is due to the improper neutralization of OS commands when certain fields are passed to the underlying OS. Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: Mennekes Smart / Premium Chargingpoints (affected versions not specified) Description: The authenticated time setting capability of the firmware for Mennekes Smart / Premium Chargingpoints can be abused for command execution because OS commands are improperly neutralized when certain fields are passed to the underlying OS. Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: Mennekes Smart / Premium Chargingpoints (affected versions not specified) Description: The issue concerns the improper neutralization of OS commands in certain fields passed to the underlying OS, allowing for command execution through the authenticated SCU firmware command. This is due to the improper sanitization of OS commands in SCU firmware commands. Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: Mennekes Smart / Premium Chargingpoints (affected versions not specified) Description: The issue concerns the "ReadFile" endpoint of the firmware, which can be exploited to read arbitrary files from the underlying operating system. This allows unauthorized access to sensitive information. Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

The issue is related to authenticated command injection in the filename of a certain .exe request, leading to remote code execution as the root user. This allows an attacker to have full control over the charging station, arbitrarily adding, modifying, and deleting files and services. The attack can be performed over any network connection serving the web interface and does not require additional mitigating measures or user interaction. The impact is critical, with potential safety implications due to the significant power of the electric vehicle chargers.

The issue is related to an improper neutralization of special elements used in a command, also known as 'Command Injection', which allows OS Command Injection as root. This gives the attacker full control over the charging station, allowing them to add, modify, and delete files and services arbitrarily. The attack can be executed over any network connection serving the web interface and does not require user interaction. The likelihood of the attack is moderate, but the impact is critical, with potential safety implications due to the high power used by the EV charger.

The issue is related to an Improper Neutralization of Special Elements used in a Command, also known as a 'Command Injection' vulnerability, which allows OS Command Injection as root. This gives an attacker full control over the charging station, allowing them to arbitrarily add, modify, and delete files and services. The attack requires authentication but does not need special conditions or user interaction. The vulnerability can be automated and may have a potential safety impact due to the charger handling significant power.

The issue is related to an improper neutralization of special elements used in a command, allowing OS command injection as root. This gives an attacker full control over the charging station, enabling them to add, modify, and delete files and services arbitrarily. The attack can be automated and has a potential safety impact due to the charger handling significant power. Any network interface serving the web UI is vulnerable, and the attack requires low-level authentication but no user interaction.

The issue is related to an improper neutralization of special elements used in a command, allowing OS command injection as root. This gives an attacker full control over the charging station, enabling them to add, modify, and delete files and services arbitrarily. The attack can be automated and may have a potential safety impact due to the charger handling significant power. The likelihood of the attack is moderate, requiring a low-privilege account or convincing a user with such access to execute a crafted HTTP request.

The issue is related to an improper neutralization of special elements used in a command, allowing OS command injection as root. This gives an attacker full control over the charging station, enabling them to add, modify, and delete files and services arbitrarily. The attack can be automated and has a potential safety impact due to the charger handling significant power. The likelihood of the attack is moderate, requiring a low-privilege account or convincing a user with such access to execute a crafted HTTP request.

The issue is related to an improper neutralization of special elements used in a command, allowing OS command injection as root. This gives an attacker full control over the charging station, enabling them to add, modify, and delete files and services arbitrarily. The attack can be automated and has a potential safety impact due to the charger handling significant power. The likelihood of the attack is moderate, requiring the attacker to find the script name and have a low-privilege account or convince a user to execute a request. However, the impact is critical, leading to a fully compromised system.

The issue is related to command injection in a specific parameter of a .exe request, leading to remote code execution as the root user. This allows an attacker to have full control over the charging station, arbitrarily adding, modifying, and deleting files and services. The attack can be executed over any network connection the station is listening to and serves the web interface. A compromised charger can be used to "pivot" onto networks that should otherwise be closed, causing a low confidentiality and integrity impact on subsequent systems. The vulnerability can potentially have a safety impact due to the device handling significant amounts of power.