CVE-2024-43660

Description

The CGI script <redacted>.sh can be used to download any file on the filesystem. This issue affects Iocharger firmware for AC model chargers beforeversion 24120701. Likelihood: High, but credentials required. Impact: Critical – The script can be used to download any file on the filesystem, including sensitive files such as /etc/shadow, the CGI script source code or binaries and configuration files. CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/S:P/AU:Y CVSS clarification. The attack can be executed over any network connection the station is listening to and serves the web interface (AV:N), and there are no additional security measure sin place that need to be circumvented (AC:L), the attack does not rely on preconditions (AT:N). The attack does require authentication, but the level of authentication is irrelevant (PR:L), it does not require user interaction (UI:N). The confidentiality of all files of the devicd can be compromised (VC:H/VI:N/VA:N). There is no impact on subsequent systems. (SC:N/SI:N/SA:N). While this device is an EV charger handing significant amounts of power, this attack in isolation does not have a safety impact. The attack can be automated (AU:Y).

Reserved 2024-08-14 | Published 2025-01-09 | Updated 2025-01-09 | Assigner DIVD

Problem types

CWE-552 Files or Directories Accessible to External Parties

Product status

Default status
unaffected

Any version before 24120701
affected

Credits

Wilco van Beijnum finder

Harm van den Brink (DIVD) analyst

Frank Breedijk (DIVD) analyst

References

csirt.divd.nl/DIVD-2024-00035/ third-party-advisory

csirt.divd.nl/CVE-2024-43660/ third-party-advisory

iocharger.com product

cve.org (CVE-2024-43660)

nvd.nist.gov (CVE-2024-43660)

Download JSON