What’s Vulnerable › Products
Iocharger firmware for AC models vulnerabilities
15 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 15 published in the last 12 months.
Check whether your Iocharger firmware for AC models version is affected
Latest Iocharger firmware for AC models vulnerabilities
- CVE-2024-43663 — Buffer overflow vulnerabilities in CGI scripts lead to segfault (CVSS 9.8)
- CVE-2024-43662 — Authenticated arbitrary file upload to /tmp/ and /tmp/upload/ (CVSS 5.3)
- CVE-2024-43661 — Buffer overflow in <redacted>.so leads to DoS of OCPP service (CVSS 9.8)
- CVE-2024-43660 — Arbitrary file download using <redacted>.sh (CVSS 7.5)
- CVE-2024-43659 — Plaintext default credentials in firmware (CVSS 7.2)
- CVE-2024-43658 — Using the <redacted> action or <redacted>.sh script, arbitrary files and directories can be deleted using directory traversal. (CVSS 7.2)
- CVE-2024-43657 — When uploading new firmware, a shell script inside a firmware file is executed during its processing. This can be used to craft a custom firmware file with a custom script with arbitrary code, which will then be executed on the charging station. (CVSS 8.8)
- CVE-2024-43656 — A backup can be manipulated and then restored to create arbitrary files inside the <redacted> directory. A CGI script can be added to the web directory this way, allowing for full remote code execution. (CVSS 8.8)
- CVE-2024-43655 — Any authenticated users can execute OS commands as root using the <redacted>.sh CGI script. (CVSS 9.3)
- CVE-2024-43654 — Authenticated command injection in the <redacted> action leads to full remote code execution as root on the charging station (CVSS 8.8)
- CVE-2024-43653 — Authenticated command injection in the <redacted> action leads to full remote code execution as root on the charging station (CVSS 8.8)
- CVE-2024-43651 — Authenticated command injection in the <redacted> action leads to full remote code execution as root on the charging station (CVSS 9.3)
- CVE-2024-43650 — Authenticated command injection in the <redacted> action leads to full remote code execution as root on the charging station (CVSS 9.3)
- CVE-2024-43649 — Authenticated command injection via <redacted>.exe <redacted> parameter (CVSS 8.8)
- CVE-2024-43648 — Authenticated command injection via <redacted>.exe <redacted> parameter (CVSS 8.8)