S. Eisenreich-Dietz

The web server contains a resource exhaustion issue where an unauthenticated remote attacker can send PUT requests to the '/tmp/' endpoint. This action causes the server to create persistent files containing attacker-controlled data within the `/opt/myapp/webserver/` directory. Because the web server attempts to move these files into a non-existent directory, they are not removed. Continuous requests can exhaust the available storage, leading to a denial-of-service condition.

The web server contains multiple unauthenticated denial-of-service issues. A remote attacker can trigger a device reboot, reset the device, clear application data, or cause a segmentation fault to terminate the web server by invoking specific HTTP endpoints. Furthermore, several action endpoints use unsafe string operations, specifically `sprintf()` and `strcat()`, without proper bounds checking when processing attacker-controlled parameters. This allows crafted input to cause buffer overflows, leading to web server crashes. The affected endpoints are 'onRestart', 'onReset', 'ClearData', 'uploadInvFile', 'getIndiaRPData', 'YearCaparity', 'TotalfaultData', 'recordData', 'InvHistoryData', 'CollectHistoryData', 'InvFaultData', 'GetPortTableByParm', and 'UpdatePortConfig'.

A hard-coded or default root account credential allows an unauthenticated remote attacker to gain root-level access to the device through the exposed SSH service. The root password can be retrieved from the password hash located in the `/etc/shadow` file and used to authenticate via SSH, granting full administrative control of the device.

An unauthenticated SQL injection exists in the web server where multiple HTTP endpoints incorporate attacker-controlled parameters directly into SQLite queries without sufficient validation or parameterization. This allows a remote unauthenticated attacker to read, modify, or delete data stored in the device's `CCU.db` database.

The device exposes a UART (Universal Asynchronous Receiver-Transmitter, a hardware communication protocol) interface on the circuit board without sufficient protection. An attacker with physical access can connect to this interface to monitor the boot process and runtime debug output. This exposure leaks sensitive data, including operating system details, software versions, network configuration, and filesystem paths, which can be used to facilitate further compromise of the system.

The web server contains an authentication bypass. If a user has previously authenticated to the device, an unauthenticated attacker can directly access protected functionality via the '/index.asp' endpoint without valid credentials. This allows unauthorized access to features intended for authenticated users, potentially exposing or modifying device configuration and data. Additionally, logging out while in this bypassed state can cause the web server to crash.

A heap-based buffer overflow occurs in the `set ap param` command processed by the '/localcfg' endpoint. An authenticated attacker can provide oversized input to trigger this issue, which may lead to a denial of service or the execution of arbitrary code. A heap-based buffer overflow is a memory corruption error that happens when a program writes more data to a heap-allocated memory block than it can hold.

Exposed hardware recovery pins allow unrestricted access to the NXP i.MX6 recovery mode. An attacker with physical access can boot attacker-controlled code in memory to modify or extract firmware and other sensitive data.

The device exposes an accessible UART (Universal Asynchronous Receiver-Transmitter, a hardware communication protocol) interface. This allows an attacker with physical access to interrupt the boot process and access the U-Boot bootloader, which can be used to modify the boot configuration or file system to gain operating system access.

Two undocumented privileged accounts exist in the firmware. These accounts utilize vendor-defined password derivation mechanisms based on device-specific values. An attacker who knows the algorithm and the necessary inputs can authenticate to the web management interface with administrative privileges.

The firmware contains a hard-coded authentication token that allows the bypass of authorization checks for multiple management endpoints. An attacker can use this special token value to access privileged functionality without providing valid authentication.

Unauthenticated remote code execution is possible via the service listening on TCP port 9002. A crafted request to the '/test' endpoint allows the device to download, extract, and execute files controlled by an attacker with root privileges.

An unauthenticated attacker can execute arbitrary operating system commands via OS command injection. This occurs through the '/test' endpoint exposed on TCP port 9002 by providing crafted input in the `url` parameter.

OS command injection occurs when processing OCPP GetDiagnostics requests. A malicious or compromised OCPP server can provide a crafted diagnostics URL that allows for arbitrary command execution on the charging station.

An authentication bypass allows an unauthenticated remote attacker to change the user account password. This is achieved by sending a crafted POST request to the '/operator/operator' endpoint.

An authenticated user with low privileges can achieve privilege escalation by sending crafted POST requests. This allows the user to change the passwords of the manufacturer and admin (operator) accounts.