Mennekes Amtron Authentication Bypass and Privilege Escalation (CVE-2026-8979/80)

Multiple Vulnerabilities in Mennekes Amtron Series Devices Vulnerability Overview The Mennekes Amtron series devices contain authentication bypass and privilege escalation vulnerabilities. Unauthorized attackers can change user account credentials via crafted POST requests, while low-privileged attackers can escalate privileges by overwriting the passwords of manufacturer and administrator accounts. Successful exploitation may result in full device takeover or loss of access control for charging infrastructure. Affected Products Amtron Professional Amtron Professional (Eichrecht) Amedio Professional Amtron Charge Control Amtron Professional Twincharge Smart-T PhC Remediation Update to the latest firmware. Temporary Solution Restrict access to the devices. Technical Details 1) Authentication Bypass (CVE-2026-8979) An unauthorized attacker can change a user account password using the following POST request: 2) Privilege Escalation (CVE-2026-8980) A low-privileged attacker can change the passwords of administrator and manufacturer accounts using the following POST requests: Timeline 2025-02-24: Contacted psirt@mennekes.de 2025-02-25: Vulnerability confirmed and forwarded to BENDER (the device manufacturer) 2025-03-18: Inquired about the update status, including fixes, CVE numbers, fixed versions, and affected products. Replied that no CVEs would be created 2025-05-28: Security advisory published Authors Sebastian Dietz: Security researcher at CyberDanube, specializing in digital twins, information security risk assessment, and firmware analysis Thomas Weber: Co-founder and security researcher at CyberDanube, specializing in embedded systems, IoT, and OT Technical Usage The vulnerabilities were verified manually by simulating the device using "MEDUSA Extensible Firmware Runtime" (www.medusa.re).

Goal Reached Thanks to every supporter — we hit 100%!

Mennekes Amtron Authentication Bypass and Privilege Escalation (CVE-2026-8979/80)