CVE-2024-11666 — AI Deep Analysis Summary

🚨 **Essence**: ONEKEY Platform suffers from **Data Forgery** due to disabled mutual authentication. 📉 **Consequences**: Remote attackers can execute **arbitrary commands** with elevated privileges on affected devices.

🛡️ **Root Cause**: **CWE-345** (Insufficient Verification of Data Authenticity). The core flaw is that **mutual authentication is disabled everywhere**, allowing untrusted data injection.

🏢 **Affected**: **ONEKEY Platform** (specifically the **cph2_echarge_firmware** by vendor **hardy-barth**). These are **EV charging station controllers**.

💀 **Attacker Capabilities**: Remote, **unauthenticated** users can gain **elevated privileges**.…

⚡ **Exploitation Threshold**: **Low**. Access Vector is **Network (AV:N)**. No Authentication (PR:N) or User Interaction (UI:N) required.…

🔍 **Public Exploit**: **No**. The `pocs` list is empty. No public Proof-of-Concept or wild exploitation code is currently available in the provided data.

🔎 **Self-Check**: Scan for **ONEKEY Platform** components in EV charging infrastructure. Verify if **mutual authentication** is enabled on the `cph2_echarge_firmware`. Look for unauthorized command execution logs.

🩹 **Official Fix**: **Yes**. The vendor (hardy-barth/ONEKEY) published an advisory on **2024-11-24**. Users should check the official ONEKEY resource page for patches.

🚧 **No Patch Workaround**: Since auth is disabled globally, **network segmentation** is critical. Isolate EV charging controllers from public networks. Restrict access to management interfaces strictly.

🔥 **Urgency**: **HIGH**. CVSS Score is **Critical** (implied by H/H/H impacts). Although AC is High, the lack of auth requirement and potential for remote code execution makes immediate patching essential.