CVE-2024-43657
Published: 09 January 2025
Description
Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability allows OS Command Injection as root This issue affects Iocharger firmware for AC model chargers before version 24120701. Likelihood: High. However, the attacker will need a (low privilege) account to gain access to the action.exe CGI binary and upload the crafted firmware file, or convince a user with such access to upload it. Impact: Critical – The attacker has full control over the charging station as the root user, and can arbitrarily add, modify and deletefiles and services. CVSS clarification: Any network interface serving the web ui is vulnerable (AV:N) and there are not additional security measures to circumvent (AC:L), nor does the attack require and existing preconditions (AT:N). The attack is authenticated, but the level of authentication does not matter (PR:L), nor is any user interaction required (UI:N). The attack leads to a full compromised (VC:H/VI:H/VA:H), and compromised devices can be used to pivot into networks that should potentially not be accessible (SC:L/SI:L/SA:H). Becuase this is an EV charger handing significant power, there is a potential safety impact (S:P). This attack can be automated (AU:Y).
Security Summary
CVE-2024-43657 is an Improper Neutralization of Special Elements used in a Command vulnerability (CWE-78, CWE-434) that enables OS command injection with root privileges. It affects the Iocharger firmware for AC model chargers running versions prior to 24120701, specifically targeting the action.exe CGI binary accessible via the web UI.
An attacker with a low-privilege account can exploit this over any network interface serving the web UI by uploading a crafted firmware file, or by convincing a user with such access to do so. Successful exploitation grants full root control over the charging station, allowing arbitrary addition, modification, and deletion of files and services. The vulnerability carries a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), with high likelihood, critical impact, and potential for network pivoting or safety risks due to the charger's power handling.
DIVD advisories at https://csirt.divd.nl/CVE-2024-43657/ and https://csirt.divd.nl/DIVD-2024-00035/ document the issue, recommending update to firmware version 24120701 or later as the primary mitigation. The vendor site https://iocharger.com provides further details.
Details
- CWE(s)