CVE-2024-43660
Jan. 9, 2025, 3:15 p.m.
7.1
High
Description
The CGI script <redacted>.sh can be used to download any file on the filesystem.
This issue affects Iocharger firmware for AC model chargers beforeversion 24120701.
Likelihood: High, but credentials required.
Impact: Critical – The script can be used to download any file on the filesystem, including sensitive files such as /etc/shadow, the CGI script source code or binaries and configuration files.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/S:P/AU:Y
CVSS clarification. The attack can be executed over any network connection the station is listening to and serves the web interface (AV:N), and there are no additional security measure sin place that need to be circumvented (AC:L), the attack does not rely on preconditions (AT:N). The attack does require authentication, but the level of authentication is irrelevant (PR:L), it does not require user interaction (UI:N). The confidentiality of all files of the devicd can be compromised (VC:H/VI:N/VA:N). There is no impact on subsequent systems. (SC:N/SI:N/SA:N). While this device is an EV charger handing significant amounts of power, this attack in isolation does not have a safety impact. The attack can be automated (AU:Y).
Product(s) Impacted
| Product | Versions |
|---|---|
| Iocharger firmware for AC model chargers |
|
Weaknesses
Common security weaknesses mapped to this vulnerability.
CWE-552
Files or Directories Accessible to External Parties
The product makes files or directories accessible to unauthorized actors, even though they should not be.
Tags
CVSS Score
CVSS Data - 4.0
- Attack Vector: NETWORK
- Attack Complexity: LOW
- Attack Requirements: NONE
- Privileges Required: LOW
- User Interaction: NONE
- Scope:
- Confidentiality Impact: HIGH
- Integrity Impact: NONE
- Availability Impact: NONE
- Exploit Maturity: NOT_DEFINED
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:X/V:X/RE:X/U:X
Timeline
Published: Jan. 9, 2025, 8:15 a.m.
Last Modified: Jan. 9, 2025, 3:15 p.m.
Last Modified: Jan. 9, 2025, 3:15 p.m.
Status : Awaiting Analysis
CVE has been marked for Analysis. Normally once in this state the CVE will be analyzed by NVD staff within 24 hours.
More infoSource
csirt@divd.nl
*Disclaimer: Some vulnerabilities do not have an associated CPE. To enhance the data, we use AI to infer CPEs based on CVE details. This is an automated process and might not always be accurate.