# Iocharger firmware for AC models. Every CVE that names Iocharger firmware for AC models among its affected products, newest first. Vendors and products are as the CNA wrote them. ## Records, newest first - [Authenticated command injection in the \ action leads to full remote code execution as root on the charging station](https://agentprime.io/advisories/CVE-2024-43651.md) `CVE-2024-43651` · CVE record: Iocharger Iocharger firmware for AC models · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 9 Jan 2025 · Tags: Command injection, Privilege escalation - [Using the \ action or \.sh script, arbitrary files and directories can be deleted using directory traversal.](https://agentprime.io/advisories/CVE-2024-43658.md) `CVE-2024-43658` · CVE record: Iocharger Iocharger firmware for AC models · CVSS 7.2 High · Not analysed yet · Published 9 Jan 2025 · Tags: Path traversal, CWE-27 - [Authenticated command injection in the \ action leads to full remote code execution as root on the charging station](https://agentprime.io/advisories/CVE-2024-43654.md) `CVE-2024-43654` · CVE record: Iocharger Iocharger firmware for AC models · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 9 Jan 2025 · Tags: Command injection, Privilege escalation - [Authenticated command injection via \.exe \ parameter](https://agentprime.io/advisories/CVE-2024-43649.md) `CVE-2024-43649` · CVE record: Iocharger Iocharger firmware for AC models · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 9 Jan 2025 · Tags: Command injection, Privilege escalation - [Arbitrary file download using \.sh](https://agentprime.io/advisories/CVE-2024-43660.md) `CVE-2024-43660` · CVE record: Iocharger Iocharger firmware for AC models · CVSS 7.1 High · Not analysed yet · Published 9 Jan 2025 · Tags: Information disclosure - [Authenticated command injection in the \ action leads to full remote code execution as root on the charging station](https://agentprime.io/advisories/CVE-2024-43653.md) `CVE-2024-43653` · CVE record: Iocharger Iocharger firmware for AC models · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 9 Jan 2025 · Tags: Command injection, Privilege escalation - [Buffer overflow in \.so leads to DoS of OCPP service](https://agentprime.io/advisories/CVE-2024-43661.md) `CVE-2024-43661` · CVE record: Iocharger Iocharger firmware for AC models · CVSS 7.1 High · Not analysed yet · Published 9 Jan 2025 · Tags: Memory corruption - [When uploading new firmware, a shell script inside a firmware file is executed during its processing. This can be used to craft a custom firmware file with a custom script with arbitrary code, which…](https://agentprime.io/advisories/CVE-2024-43657.md) `CVE-2024-43657` · CVE record: Iocharger Iocharger firmware for AC models · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 9 Jan 2025 · Tags: Command injection, Unrestricted file upload - [Authenticated command injection via \.exe \ parameter](https://agentprime.io/advisories/CVE-2024-43648.md) `CVE-2024-43648` · CVE record: Iocharger Iocharger firmware for AC models · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 9 Jan 2025 · Tags: Command injection, Privilege escalation - [Buffer overflow vulnerabilities in CGI scripts lead to segfault](https://agentprime.io/advisories/CVE-2024-43663.md) `CVE-2024-43663` · CVE record: Iocharger Iocharger firmware for AC models · CVSS 5.3 Medium · Not analysed yet · Published 9 Jan 2025 · Tags: Memory corruption - [Plaintext default credentials in firmware](https://agentprime.io/advisories/CVE-2024-43659.md) `CVE-2024-43659` · CVE record: Iocharger Iocharger firmware for AC models · CVSS 8.3 High · Not analysed yet · Published 9 Jan 2025 · Tags: Hard-coded credentials, CWE-256, CWE-1393 - [A backup can be manipulated and then restored to create arbitrary files inside the \ directory. A CGI script can be added to the web directory this way, allowing for full remote code executi…](https://agentprime.io/advisories/CVE-2024-43656.md) `CVE-2024-43656` · CVE record: Iocharger Iocharger firmware for AC models · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 9 Jan 2025 · Tags: Command injection, Unrestricted file upload - [Authenticated arbitrary file upload to /tmp/ and /tmp/upload/](https://agentprime.io/advisories/CVE-2024-43662.md) `CVE-2024-43662` · CVE record: Iocharger Iocharger firmware for AC models · CVSS 5.3 Medium · Not analysed yet · Published 9 Jan 2025 · Tags: Unrestricted file upload, Broken access control - [Authenticated command injection in the \ action leads to full remote code execution as root on the charging station](https://agentprime.io/advisories/CVE-2024-43650.md) `CVE-2024-43650` · CVE record: Iocharger Iocharger firmware for AC models · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 9 Jan 2025 · Tags: Command injection, Privilege escalation - [Any authenticated users can execute OS commands as root using the \.sh CGI script.](https://agentprime.io/advisories/CVE-2024-43655.md) `CVE-2024-43655` · CVE record: Iocharger Iocharger firmware for AC models · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 9 Jan 2025 · Tags: Command injection, Privilege escalation ## Filters and formats Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page. - The same list as JSON: - Every list: , critical: ; by weakness: and the other tags in ; by technology: `/advisories/technology/.md` (`fortinet-fortimail`) --- The web page: . Everything for agents: .