CVE-2024-43656
Published: 09 January 2025
Description
Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability allows OS Command Injection as root This issue affects Iocharger firmware for AC model chargers before version 24120701. Likelihood: Moderate – It might be difficult for an attacker to identify the file structure of the <redated> directory, and then modify the backup to add a new CGI script in the correct directory. Furthermore, the attacker will need an account to restore the settings backup, or convince a user with such access to upload a modified backup file. Impact: Critical – The attacker has full control over the charging station as the root user, and can arbitrarily add, modify and deletefiles and services. CVSS clarification: Any network interface serving the web ui is vulnerable (AV:N) and there are not additional security measures to circumvent (AC:L), nor does the attack require and existing preconditions (AT:N). The attack is authenticated, but the level of authentication does not matter (PR:L), nor is any user interaction required (UI:N). The attack leads to a full compromised (VC:H/VI:H/VA:H), and compromised devices can be used to pivot into networks that should potentially not be accessible (SC:L/SI:L/SA:H). Becuase this is an EV charger handing significant power, there is a potential safety impact (S:P). This attack can be automated (AU:Y).
Security Summary
CVE-2024-43656 is an improper neutralization of special elements used in a command, classified as a command injection vulnerability (CWE-78, CWE-434), that enables OS command injection with root privileges. It affects the Iocharger firmware for AC model chargers running versions prior to 24120701. The vulnerability is accessible over any network interface serving the web UI, with a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), reflecting network accessibility, low attack complexity, low privileges required, no user interaction, and high impact on confidentiality, integrity, and availability.
An attacker with low-privileged access (PR:L), such as any authenticated account, can exploit this vulnerability over the network by modifying a settings backup file to inject a new CGI script into the correct directory within the redacted file structure. This requires identifying the backup file structure, which is described as moderately difficult, and either possessing an account capable of restoring backups or convincing a legitimate user to upload the tampered file. Successful exploitation grants full root-level control over the charging station, allowing arbitrary addition, modification, or deletion of files and services, with potential to pivot into otherwise inaccessible networks (SC:L/SI:L/SA:H) and safety impacts due to the EV charger's power handling capabilities (S:P).
Advisories from DIVD CSIRT (DIVD-2024-00035) and the vendor at iocharger.com detail the issue, with mitigation centered on updating to firmware version 24120701 or later to address the command injection flaw. Practitioners should review these resources for full patch instructions and verify network exposure of affected web UIs.
Details
- CWE(s)