Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2024-43650— Authenticated command injection in the <redacted> action leads to full remote code execution as root on the charging station

Quick assessment

Affected
Iocharger Iocharger firmware for AC models
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

iocharger是中国银河樟坛（iocharger）公司的一个电动汽车充电和智能能源管理解决方案。 iocharger 24120701之前版本存在安全漏洞，该漏洞源于命令中使用的特殊元素不当中和，允许以root身份进行操作系命令注入。

AI Predicted 9.8 Difficulty: Easy EPSS 1.67% · P77
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2024-43650

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Authenticated command injection in the <redacted> action leads to full remote code execution as root on the charging station
Source: CVE Program / CVE List V5
Vulnerability Description
Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in Iocharger firmware for AC models allows OS Command Injection as root This issue affects  firmware versions before 24120701. Likelihood: Moderate – The <redacted> binary does not seem to be used by the web interface, so it might be more difficult to find. It seems to be largely the same binary as used by the Iocharger Pedestal charging station, however. The attacker will also need a (low privilege) account to gain access to the <redacted> binary, or convince a user with such access to execute a crafted HTTP request. Impact: Critical – The attacker has full control over the charging station as the root user, and can arbitrarily add, modify and delete files and services. CVSS clarification: The attack can be executed over any network connection serving the web interface (AV:N). There are no additional measures that need to be circumvented (AC:L) or attack preconditions (AT:N). THe attack is privileged, but the level does not matter (PR:L) and does not require user interaction (UI:N). Attack leads to full system compromised (VC:H/VI:H/VA:H) and compromised devices can be used to "pivot" to other networks that should be unreachable (SC:L/SI:L/SA:H). Because this an EV charger using high power, there is a potential safety impact (S:P). The attack can be automated (AU:Y).
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:H/S:P/AU:Y
Source: CVE Program / CVE List V5
Vulnerability Type
OS命令中使用的特殊元素转义处理不恰当(OS命令注入)
Source: CVE Program / CVE List V5
Vulnerability Title
iocharger 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
iocharger是中国银河樟坛（iocharger）公司的一个电动汽车充电和智能能源管理解决方案。 iocharger 24120701之前版本存在安全漏洞，该漏洞源于命令中使用的特殊元素不当中和，允许以root身份进行操作系命令注入。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
Iocharger Iocharger firmware for AC models 0 ~ 24120701 -

II. Public POCs for CVE-2024-43650

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2024-43650

请登录查看更多情报信息。

Vendor Advisories for CVE-2024-43650 (2)

Vendor Pages for CVE-2024-43650 (1)

Same Patch Batch · Iocharger · 2025-01-09 · 16 CVEs total

CVE-2024-43658 Using the <redacted> action or <redacted>.sh script, arbitrary files and directories can b
CVE-2024-43661 Buffer overflow in <redacted>.so leads to DoS of OCPP service
CVE-2024-43654 Authenticated command injection in the <redacted> action leads to full remote code executi
CVE-2024-43655 Any authenticated users can execute OS commands as root using the <redacted>.sh CGI script
CVE-2024-43648 Authenticated command injection via <redacted>.exe <redacted> parameter
CVE-2024-43657 When uploading new firmware, a shell script inside a firmware file is executed during its
CVE-2024-43662 Authenticated arbitrary file upload to /tmp/ and /tmp/upload/
CVE-2024-43653 Authenticated command injection in the <redacted> action leads to full remote code executi
CVE-2024-43656 A backup can be manipulated and then restored to create arbitrary files inside the <redact
CVE-2024-43663 Buffer overflow vulnerabilities in CGI scripts lead to segfault
CVE-2024-43652 Authenticated command injection in the <redacted> action leads to full remote code executi
CVE-2024-43649 Authenticated command injection via <redacted>.exe <redacted> parameter
CVE-2024-43659 Plaintext default credentials in firmware
CVE-2024-43651 Authenticated command injection in the <redacted> action leads to full remote code executi
CVE-2024-43660 Arbitrary file download using <redacted>.sh

IV. Related Vulnerabilities

Same product: Iocharger firmware for AC models
Same vendor: Iocharger
Same weakness: CWE-78