Harm Van Den Brink

Name of the Vulnerable Software and Affected Versions: Mennekes Smart / Premium Chargingpoints (affected versions not specified) Description: The issue concerns the authenticated firmware update capability of the Mennekes Smart / Premium Chargingpoints, which can be exploited for command execution. This is due to the improper neutralization of OS commands when certain fields are passed to the underlying OS. Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: Mennekes Smart / Premium Chargingpoints (affected versions not specified) Description: The authenticated time setting capability of the firmware for Mennekes Smart / Premium Chargingpoints can be abused for command execution because OS commands are improperly neutralized when certain fields are passed to the underlying OS. Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: Mennekes Smart / Premium Chargingpoints (affected versions not specified) Description: The issue concerns the improper neutralization of OS commands in certain fields passed to the underlying OS, allowing for command execution through the authenticated SCU firmware command. This is due to the improper sanitization of OS commands in SCU firmware commands. Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: Mennekes Smart / Premium Chargingpoints (affected versions not specified) Description: The issue concerns the "ReadFile" endpoint of the firmware, which can be exploited to read arbitrary files from the underlying operating system. This allows unauthorized access to sensitive information. Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: Mennekes Smart / Premium Chargingpoints (affected versions not specified) Description: The web configuration interface of the firmware for Mennekes Smart / Premium Chargingpoints has a issue where many fields can be exploited to execute arbitrary SQL commands due to insufficient neutralization of input values. Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

The issue is related to command injection in a specific parameter of a .exe request, leading to remote code execution as the root user. This allows an attacker to have full control over the charging station, arbitrarily adding, modifying, and deleting files and services. The attack can be executed over any network connection the station is listening to and serves the web interface. A compromised charger can be used to "pivot" onto networks that should otherwise be closed, causing a low confidentiality and integrity impact on subsequent systems. The vulnerability can potentially have a safety impact due to the device handling significant amounts of power.

The issue is related to authenticated command injection in the filename of a certain .exe request, leading to remote code execution as the root user. This allows an attacker to have full control over the charging station, arbitrarily adding, modifying, and deleting files and services. The attack can be performed over any network connection serving the web interface and does not require additional mitigating measures or user interaction. The impact is critical, with potential safety implications due to the significant power of the electric vehicle chargers.

The issue is related to an improper neutralization of special elements used in a command, also known as 'Command Injection', which allows OS Command Injection as root. This gives the attacker full control over the charging station, allowing them to add, modify, and delete files and services arbitrarily. The attack can be executed over any network connection serving the web interface and does not require user interaction. The likelihood of the attack is moderate, but the impact is critical, with potential safety implications due to the high power used by the EV charger.

The issue is related to an Improper Neutralization of Special Elements used in a Command, also known as a 'Command Injection' vulnerability, which allows OS Command Injection as root. This gives an attacker full control over the charging station, allowing them to arbitrarily add, modify, and delete files and services. The attack requires authentication but does not need special conditions or user interaction. The vulnerability can be automated and may have a potential safety impact due to the charger handling significant power.

The issue is related to an Improper Neutralization of Special Elements used in a Command, also known as a Command Injection vulnerability. This allows an attacker to perform OS Command Injection as the root user, giving them full control over the charging station. The attacker needs a low-privilege account to access the vulnerable binary or convince a user with such access to execute a crafted HTTP request. The impact is critical, as the attacker can arbitrarily add, modify, and delete files and services.

The issue is related to an improper neutralization of special elements used in a command, allowing OS command injection as root. This gives an attacker full control over the charging station, enabling them to add, modify, and delete files and services arbitrarily. The attack can be automated and has a potential safety impact due to the charger handling significant power. The likelihood of the attack is moderate, requiring a low-privilege account or convincing a user with such access to execute a crafted HTTP request.

The issue is related to an improper neutralization of special elements used in a command, allowing OS command injection as root. This gives an attacker full control over the charging station, enabling them to add, modify, and delete files and services arbitrarily. The attack can be automated and may have a potential safety impact due to the charger handling significant power. The likelihood of the attack is moderate, requiring a low-privilege account or convincing a user with such access to execute a crafted HTTP request.

The issue is related to an improper neutralization of special elements used in a command, allowing OS command injection as root. This gives an attacker full control over the charging station, enabling them to add, modify, and delete files and services arbitrarily. The attack can be automated and has a potential safety impact due to the charger handling significant power. The likelihood of the attack is moderate, requiring the attacker to find the script name and have a low-privilege account or convince a user to execute a request. However, the impact is critical, leading to a fully compromised system.

The issue is related to improper neutralization of special elements used in a command, allowing OS command injection as root. This gives an attacker full control over the charging station, enabling them to add, modify, and delete files and services arbitrarily. The attack can be automated and may have a potential safety impact due to the charger handling significant power. The likelihood of the attack is moderate, requiring an attacker to identify the file structure of a specific directory and modify a backup to add a new CGI script, or convince a user with access to upload a modified backup file.

The issue is related to an improper neutralization of special elements used in a command, allowing OS command injection as root. This gives an attacker full control over the charging station, enabling them to add, modify, and delete files and services arbitrarily. The attack can be automated and has a potential safety impact due to the charger handling significant power. Any network interface serving the web UI is vulnerable, and the attack requires low-level authentication but no user interaction.

The issue is related to a patch traversal vulnerability, which allows for external control of file name or path, enabling the deletion of arbitrary files. This can severely impact the integrity and availability of the charging station, as it can be used to delete any file, including binaries necessary for the station's operation. The attack requires authentication but can be automated, and it compromises the integrity and availability of the device.

The issue allows an attacker to obtain default credentials that are the same across all Iocharger AC model EV chargers by accessing a file after gaining access to the firmware of a charging station. The estimated number of potentially affected devices is not provided. The impact of this issue is critical, as it could allow an attacker to log into many Iocharger charging stations and execute arbitrary commands via the System → Custom page. The attack requires high privileges and no user interaction, and it can be automated.

The issue allows an attacker to download any file on the filesystem using the CGI script. This has a critical impact, as sensitive files such as /etc/shadow, the CGI script source code, or binaries and configuration files can be accessed. The attack can be executed over any network connection and requires authentication, but the level of authentication is irrelevant. The confidentiality of all files on the device can be compromised. While this device handles significant amounts of power, the attack in isolation does not have a safety impact. The attack can be automated.

The issue is related to a buffer overflow in the code that handles the deletion of certificates. This buffer overflow can be triggered by providing a long file path to the action of the CGI binary or to the CGI script. The binary or script will write this file path to a location that is then read by the .so library. The estimated likelihood of this issue is moderate, as an attacker would need to find this exploit either by obtaining the binaries involved or by trial and error, and also require a low-privilege account to gain access to the CGI binary or script. The impact is high, as the process responsible for OCPP communication will keep crashing after performing the exploit, causing a denial of service.

The issue allows attackers to upload arbitrary files to /tmp/upload/ or /tmp/ as any user, although the file upload interface is only visible to the iocadmin user. The attack requires knowledge of the CGI binary and a low-privilege account to access the binary and upload files. The impact is low, as the attacker cannot access or use the uploaded files without other vulnerabilities. The attack can be executed over any network connection serving the web interface and can be automated.