CVE-2025-22367— Mennekes smart/premium charges systems, Command injection in time setting
Quick assessment
Affected
Mennekes Smart / Premium charging stations
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
MENNEKES Ladesäule Smart是MENNEKES公司的一款智能充电桩。 MENNEKES Ladesäule Smart存在安全漏洞，该漏洞源于OS命令中和不当，可能导致命令执行。
Possible ATT&CK Techniques 1 AI
T1190 · Exploit Public-Facing Application
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2025-22367
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Mennekes smart/premium charges systems, Command injection in time setting
Source: CVE Program / CVE List V5
Vulnerability Description
The authenticated time setting capability of the firmware for Mennekes Smart / Premium Chargingpoints can be abused for command execution because OS command are improperly neutralized when certain fields are passed to the underlying OS.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:L/SI:N/SA:N/S:N/AU:Y
Source: CVE Program / CVE List V5
Vulnerability Type
OS命令中使用的特殊元素转义处理不恰当(OS命令注入)
Source: CVE Program / CVE List V5
Vulnerability Title
MENNEKES Ladesäule Smart 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
MENNEKES Ladesäule Smart是MENNEKES公司的一款智能充电桩。 MENNEKES Ladesäule Smart存在安全漏洞，该漏洞源于OS命令中和不当，可能导致命令执行。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Mennekes | Smart / Premium charging stations | * ~ 2.15 | - |
|
II. Public POCs for CVE-2025-22367
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2025-22367
请登录查看更多情报信息。
Other References for CVE-2025-22367 (2)
-
https://csirt.divd.nl/DIVD-2025-00003 vendor-advisory
-
https://csirt.divd.nl/CVE-2025-22367 third-party-advisory
Same Patch Batch · Mennekes · 2025-03-11 · 5 CVEs total
| CVE-2025-22370 | Mennekes smart/premium charges systems, SQL Injection in web configuration interface | |
| CVE-2025-22368 | Mennekes smart/premium charges systems, Command injection in sCU firmware update | |
| CVE-2025-22366 | Mennekes smart/premium charges systems, Command injection in firmware upgrade | |
| CVE-2025-22369 | Mennekes smart/premium charges systems, Arbitrary file download using ReadFile endpoint |
IV. Related Vulnerabilities
Same product: Smart / Premium charging stations
-
CVE-2025-22366
Mennekes smart/premium charges systems, Command injection in -
CVE-2025-22369
Mennekes smart/premium charges systems, Arbitrary file downl -
CVE-2025-22370
Mennekes smart/premium charges systems, SQL Injection in web -
CVE-2025-22368
Mennekes smart/premium charges systems, Command injection in
Same vendor: Mennekes
Same weakness: CWE-78
-
CVE-2026-55673
PowSyBl: Command Injection in LocalCommandExecutor-s -
CVE-2026-55378
JS Recon: Command injection in PR Branch Checker workflow vi -
CVE-2026-75486
Synk Sweater Comb < 3.8.8 Command Injection via .vervet.yaml -
CVE-2026-75123
PLANET GS-4210-16P2S Command Injection via dispatcher.cgi we -
CVE-2026-75122
PLANET GS-4210-16P2S Command Injection via httpuploadcert.cg
V. Comments for CVE-2025-22367
No comments yet