CVE-2024-43652

Summary

CVE-2024-43652 is a Command Injection vulnerability affecting Iocharger firmware for AC model chargers prior to version 24120701. This issue allows an attacker, with a low privilege account or through user manipulation, to execute OS commands as the root user. The impact is critical, as the attacker can arbitrarily modify, delete files, and manipulate services on the charging station. The binary responsible for this vulnerability, <redacted>, does not seem to be directly used by the web interface, but has the potential to pose a significant risk if accessed.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.