Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2024-43660— Arbitrary file download using <redacted>.sh

Quick assessment

Affected
Iocharger Iocharger firmware for AC models
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

iocharger是中国银河樟坛（iocharger）公司的一个电动汽车充电和智能能源管理解决方案。 iocharger存在安全漏洞。攻击者利用该漏洞可以下载文件系统上的任何文件。

AI Predicted 8.3 Difficulty: Easy EPSS 0.59% · P48
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2024-43660

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Arbitrary file download using <redacted>.sh
Source: CVE Program / CVE List V5
Vulnerability Description
The CGI script <redacted>.sh can be used to download any file on the filesystem. This issue affects Iocharger firmware for AC model chargers beforeversion 24120701. Likelihood: High, but credentials required. Impact: Critical – The script can be used to download any file on the filesystem, including sensitive files such as /etc/shadow, the CGI script source code or binaries and configuration files. CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/S:P/AU:Y CVSS clarification. The attack can be executed over any network connection the station is listening to and serves the web interface (AV:N), and there are no additional security measure sin place that need to be circumvented (AC:L), the attack does not rely on preconditions (AT:N). The attack does require authentication, but the level of authentication is irrelevant (PR:L), it does not require user interaction (UI:N). The confidentiality of all files of the devicd can be compromised (VC:H/VI:N/VA:N). There is no impact on subsequent systems. (SC:N/SI:N/SA:N). While this device is an EV charger handing significant amounts of power, this attack in isolation does not have a safety impact. The attack can be automated (AU:Y).
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/AU:Y
Source: CVE Program / CVE List V5
Vulnerability Type
对外部实体的文件或目录可访问
Source: CVE Program / CVE List V5
Vulnerability Title
iocharger 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
iocharger是中国银河樟坛（iocharger）公司的一个电动汽车充电和智能能源管理解决方案。 iocharger存在安全漏洞。攻击者利用该漏洞可以下载文件系统上的任何文件。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
Iocharger Iocharger firmware for AC models 0 ~ 24120701 -

II. Public POCs for CVE-2024-43660

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2024-43660

请登录查看更多情报信息。

Vendor Advisories for CVE-2024-43660 (2)

Vendor Pages for CVE-2024-43660 (1)

Same Patch Batch · Iocharger · 2025-01-09 · 16 CVEs total

CVE-2024-43658 Using the <redacted> action or <redacted>.sh script, arbitrary files and directories can b
CVE-2024-43661 Buffer overflow in <redacted>.so leads to DoS of OCPP service
CVE-2024-43654 Authenticated command injection in the <redacted> action leads to full remote code executi
CVE-2024-43655 Any authenticated users can execute OS commands as root using the <redacted>.sh CGI script
CVE-2024-43648 Authenticated command injection via <redacted>.exe <redacted> parameter
CVE-2024-43657 When uploading new firmware, a shell script inside a firmware file is executed during its
CVE-2024-43662 Authenticated arbitrary file upload to /tmp/ and /tmp/upload/
CVE-2024-43653 Authenticated command injection in the <redacted> action leads to full remote code executi
CVE-2024-43656 A backup can be manipulated and then restored to create arbitrary files inside the <redact
CVE-2024-43663 Buffer overflow vulnerabilities in CGI scripts lead to segfault
CVE-2024-43652 Authenticated command injection in the <redacted> action leads to full remote code executi
CVE-2024-43650 Authenticated command injection in the <redacted> action leads to full remote code executi
CVE-2024-43649 Authenticated command injection via <redacted>.exe <redacted> parameter
CVE-2024-43659 Plaintext default credentials in firmware
CVE-2024-43651 Authenticated command injection in the <redacted> action leads to full remote code executi

IV. Related Vulnerabilities

Same product: Iocharger firmware for AC models
Same vendor: Iocharger
Same weakness: CWE-552

V. Comments for CVE-2024-43660

No comments yet

Leave a comment