CVE-2024-43648

Summary

CVE-2024-43648 is a critical vulnerability affecting the Iocharger firmware for AC models before version 24120701. A command injection issue is present in the <redacted> parameter of a <redacted>.exe request, enabling remote code execution as the root user. The likelihood of an attack is moderate, as this type of vulnerability is not common and requires an attacker to access the <redacted> binary or trick a user with such access into executing a payload. The impact is significant, as the attacker gains complete control over the charging station, including the ability to add, modify, and delete files and services. This vulnerability can be exploited over any network connection the station is listening to, and there are no additional security measures in place that need to be bypassed. The attack does require authentication, but the level of authentication is irrelevant. This is a full system compromise, potentially leading to significant impacts on confidentiality, integrity, and availability of the device. Furthermore, a compromised charger could be used to gain access to other networks and potentially have safety implications (S:P). The attack can be automated (AU:Y).

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.