T. Weber

**Name of the Vulnerable Software and Affected Versions** TBEA TLogger version 2.1.0.0B0.0.0.0 **Description** The device exposes a UART (Universal Asynchronous Receiver-Transmitter, a hardware communication protocol) interface on the circuit board without sufficient protection. An attacker with physical access can connect to this interface to monitor the boot process and runtime debug output. This exposure leaks sensitive data, including operating system details, software versions, network configuration, and filesystem paths, which can be used to facilitate further compromise of the system. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** TBEA TLogger version 2.1.0.0B0.0.0.0 **Description** The web server contains an authentication bypass. If a user has previously authenticated to the device, an unauthenticated attacker can directly access protected functionality via the '/index.asp' endpoint without valid credentials. This allows unauthorized access to features intended for authenticated users, potentially exposing or modifying device configuration and data. Additionally, logging out while in this bypassed state can cause the web server to crash. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** TBEA TLogger version 2.1.0.0B0.0.0.0 **Description** The web server contains multiple unauthenticated denial-of-service issues. A remote attacker can trigger a device reboot, reset the device, clear application data, or cause a segmentation fault to terminate the web server by invoking specific HTTP endpoints. Furthermore, several action endpoints use unsafe string operations, specifically `sprintf()` and `strcat()`, without proper bounds checking when processing attacker-controlled parameters. This allows crafted input to cause buffer overflows, leading to web server crashes. The affected endpoints are 'onRestart', 'onReset', 'ClearData', 'uploadInvFile', 'getIndiaRPData', 'YearCaparity', 'TotalfaultData', 'recordData', 'InvHistoryData', 'CollectHistoryData', 'InvFaultData', 'GetPortTableByParm', and 'UpdatePortConfig'. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** TBEA TLogger version 2.1.0.0B0.0.0.0 **Description** A hard-coded or default root account credential allows an unauthenticated remote attacker to gain root-level access to the device through the exposed SSH service. The root password can be retrieved from the password hash located in the `/etc/shadow` file and used to authenticate via SSH, granting full administrative control of the device. **Recommendations** For version 2.1.0.0B0.0.0.0, change the default root account credentials to a strong, unique password. Restrict access to the SSH service to authorized users and networks only.

**Name of the Vulnerable Software and Affected Versions** TBEA TLogger version 2.1.0.0B0.0.0.0 **Description** An unauthenticated SQL injection exists in the web server where multiple HTTP endpoints incorporate attacker-controlled parameters directly into SQLite queries without sufficient validation or parameterization. This allows a remote unauthenticated attacker to read, modify, or delete data stored in the device's `CCU.db` database. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** TBEA TLogger version 2.1.0.0B0.0.0.0 **Description** The web server contains a resource exhaustion issue where an unauthenticated remote attacker can send PUT requests to the '/tmp/' endpoint. This action causes the server to create persistent files containing attacker-controlled data within the `/opt/myapp/webserver/` directory. Because the web server attempts to move these files into a non-existent directory, they are not removed. Continuous requests can exhaust the available storage, leading to a denial-of-service condition. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Autel Maxi Charger Single firmware through V1.03.51 permits unrestricted access to the NXP i.MX6 recovery mode through exposed hardware recovery pins. An attacker with physical access can boot attacker-controlled code in memory and modify or extract firmware and other sensitive data.

Two undocumented privileged accounts exist in Autel Maxi Charger Single firmware through V1.03.51. The accounts use vendor-defined password derivation mechanisms based on device-specific values, allowing an attacker with knowledge of the algorithm and required inputs to authenticate to the web management interface with administrative privileges.

**Name of the Vulnerable Software and Affected Versions** Autel Maxi Charger Single versions prior to V1.03.52 **Description** The device exposes an accessible UART (Universal Asynchronous Receiver-Transmitter, a hardware communication protocol) interface. This allows an attacker with physical access to interrupt the boot process and access the U-Boot bootloader, which can be used to modify the boot configuration or file system to gain operating system access. **Recommendations** Update Autel Maxi Charger Single to a version newer than V1.03.51.

Autel Maxi Charger Single firmware through V1.03.51 is vulnerable to OS command injection in the /test endpoint exposed on TCP port 9002. An unauthenticated attacker can supply crafted input in the url parameter to execute arbitrary operating system commands.

Autel Maxi Charger Single firmware through V1.03.51 is vulnerable to OS command injection when processing OCPP GetDiagnostics requests. A malicious or compromised OCPP server can supply a crafted diagnostics URL that results in arbitrary command execution on the charging station.

Autel Maxi Charger Single firmware through V1.03.51 allows unauthenticated remote code execution via the service listening on TCP port 9002. A crafted request to the /test endpoint can cause the device to download, extract, and execute attacker-controlled files with root privileges.

Autel Maxi Charger Single firmware through V1.03.51 contains a hard-coded authentication token that bypasses authorization checks for multiple management endpoints. An attacker can supply the special token value to invoke privileged functionality without valid authentication.

**Name of the Vulnerable Software and Affected Versions** Autel Maxi Charger Single versions prior to V1.03.52 **Description** A heap-based buffer overflow occurs in the `set ap param` command processed by the '/localcfg' endpoint. An authenticated attacker can provide oversized input to trigger this issue, which may lead to a denial of service or the execution of arbitrary code. A heap-based buffer overflow is a memory corruption error that happens when a program writes more data to a heap-allocated memory block than it can hold. **Recommendations** Update Autel Maxi Charger Single to a version newer than V1.03.51. As a temporary mitigation, restrict access to the '/localcfg' endpoint to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** versions prior to the fix for CVE-2025-41752 **Description** An XSS vulnerability exists in the `pxc portSfp.php` file. An unauthenticated remote attacker can exploit this to trick an authenticated user into clicking a malicious link, potentially altering device configuration parameters accessible through the web-based management interface (WBM). The vulnerability does not grant access to system-level resources or privileged functions. The session cookie is protected by the httpOnly flag, preventing session hijacking. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** pxc vlanIntfCfg.php (affected versions not specified) **Description** An XSS issue exists in `pxc vlanIntfCfg.php`. An unauthenticated remote attacker can manipulate an authenticated user into sending a crafted POST request to the device, potentially altering parameters accessible through the web-based management interface (WBM). The vulnerability’s impact is limited to device configuration parameters within the web application’s context and does not grant access to system-level resources or privileged functions. The session cookie is protected by the httpOnly flag, preventing session hijacking. The vulnerable file is `pxc vlanIntfCfg.php` and the attack involves manipulating a POST request. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** pxc PortCfg.php (affected versions not specified) **Description** An XSS issue exists in the pxc PortCfg.php file. An unauthenticated remote attacker can potentially trick an authenticated user into clicking a malicious link, allowing the attacker to modify device configuration parameters accessible through the web-based management interface. The vulnerability does not grant access to system-level resources or privileged functions. The session cookie is protected by the httpOnly flag, preventing session hijacking. The attack requires a user to click a link provided by the attacker. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** versions prior to 2025-41745 **Description** An XSS issue exists in the `pxc portCntr2.php` file. An unauthenticated remote attacker can manipulate an authenticated user into sending a crafted POST request to the device, potentially altering parameters accessible through the web-based management interface (WBM). The vulnerability’s impact is limited to device configuration parameters within the web application’s scope and does not grant access to system-level resources or privileged functions. The session cookie is protected by the httpOnly flag, preventing session hijacking. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** pxc portSecCfg.php (affected versions not specified) **Description** An XSS vulnerability exists in the pxc portSecCfg.php file. An unauthenticated remote attacker can exploit this to manipulate an authenticated user into sending a crafted POST request to the device. This allows modification of parameters accessible through the web-based management interface (WBM). The vulnerability’s impact is limited to device configuration parameters within the web application’s context and does not grant access to system-level resources or privileged functions. The session cookie is protected by the httpOnly flag, preventing session hijacking. The vulnerable file is `pxc portSecCfg.php`. The attack involves manipulating a POST request. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** port util.php (affected versions not specified) **Description** An XSS issue exists in the `port util.php` file. An unauthenticated remote attacker can potentially trick an authenticated user into clicking a malicious link, allowing the attacker to modify device configuration parameters accessible through the web-based management interface (WBM). The session cookie is protected by the httpOnly flag, preventing session hijacking. The issue does not grant access to system-level resources or privileged functions. The attack involves manipulating parameters available via the web interface. The API endpoint involved is not specified. The vulnerable parameter is not specified. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.