Iocharger firmware for AC models.

Authenticated command injection in the <redacted> action leads to full remote code execution as root on the charging station

• Iocharger firmware for AC models
• Command injection
• Privilege escalation

Using the <redacted> action or <redacted>.sh script, arbitrary files and directories can be deleted using directory traversal.

• Iocharger firmware for AC models
• Path traversal
• CWE-27

Authenticated command injection in the <redacted> action leads to full remote code execution as root on the charging station

• Iocharger firmware for AC models
• Command injection
• Privilege escalation

Authenticated command injection via <redacted>.exe <redacted> parameter

• Iocharger firmware for AC models
• Command injection
• Privilege escalation

Arbitrary file download using <redacted>.sh

• Iocharger firmware for AC models
• Information disclosure

Authenticated command injection in the <redacted> action leads to full remote code execution as root on the charging station

• Iocharger firmware for AC models
• Command injection
• Privilege escalation

Buffer overflow in <redacted>.so leads to DoS of OCPP service

• Iocharger firmware for AC models
• Memory corruption

When uploading new firmware, a shell script inside a firmware file is executed during its processing. This can be used to craft a custom firmware file with a custom script with arbitrary code, which…

• Iocharger firmware for AC models
• Command injection
• Unrestricted file upload

Authenticated command injection via <redacted>.exe <redacted> parameter

• Iocharger firmware for AC models
• Command injection
• Privilege escalation

Buffer overflow vulnerabilities in CGI scripts lead to segfault

• Iocharger firmware for AC models
• Memory corruption

Plaintext default credentials in firmware

• Iocharger firmware for AC models
• Hard-coded credentials
• CWE-256

A backup can be manipulated and then restored to create arbitrary files inside the <redacted> directory. A CGI script can be added to the web directory this way, allowing for full remote code executi…

• Iocharger firmware for AC models
• Command injection
• Unrestricted file upload

Authenticated arbitrary file upload to /tmp/ and /tmp/upload/

• Iocharger firmware for AC models
• Unrestricted file upload
• Broken access control

Authenticated command injection in the <redacted> action leads to full remote code execution as root on the charging station

• Iocharger firmware for AC models
• Command injection
• Privilege escalation

Any authenticated users can execute OS commands as root using the <redacted>.sh CGI script.

• Iocharger firmware for AC models
• Command injection
• Privilege escalation