CVE-2024-43648
HighSummary
W parametrach żądania <redacted>.exe występuje podatność na wstrzykiwanie poleceń, co prowadzi do zdalnego wykonania kodu jako użytkownik root. Problem ten dotyczy oprogramowania układowego Iocharger dla modeli AC przed wersją 24120701.
Risk Assessment
Atakujący może uzyskać pełną kontrolę nad stacją ładowania jako użytkownik root, co pozwala na dowolne dodawanie, modyfikowanie i usuwanie plików oraz usług. Ryzyko jest umiarkowane, ponieważ podatność może być trudna do znalezienia bez inżynierii wstecznej oprogramowania układowego.
Recommendation
Zaleca się aktualizację oprogramowania układowego Iocharger do wersji 24120701 lub nowszej, aby usunąć tę podatność. Dodatkowo, warto ograniczyć dostęp do stacji ładowania tylko do zaufanych użytkowników.
Related vulnerabilities
- CVE-2026-71449Critical
A use of hard-coded cryptographic key vulnerability in Johnson Controls EasyIO FS32 allows retrieval of embedded sensitive data. This issue affects EasyIO FS32 versions before 3.0b63.
- CVE-2026-18397Critical
This vulnerability enables unauthenticated remote code execution (RCE) on a victim's machine by exploiting a combination of cryptographic weaknesses and memory management issues in the SConnect native host component. The attack leverages an unrestricted messaging interface between an attacker-controlled web page and the native host, allowing malicious input to bypass security checks.
- CVE-2026-55395Critical
Teledyne FLIR Aware2 versions through 6.9.0.2 (PackBot) and 1.7.9 (FirstLook) contain hardcoded passwords in access control. Remote unauthenticated attackers can read them from firmware or documentation and access/reconfigure the robots.
- CVE-2026-55393Critical
Teledyne FLIR Aware2 versions through 6.9.0.2 (PackBot) and 1.7.9 (FirstLook) have unvalidated pathnames in the web interface. Remote unauthenticated attackers can use path traversal to read configuration and security parameters.
- CVE-2026-56662Critical
In GetSimple CMS CE prior to version 1.5, the UpdateCE update form lacked an anti-CSRF token and the POST handler did not verify token or request origin. A remote attacker can host a page that auto-submits a forged POST; when an authenticated admin visits it, the server performs an attacker-directed download-and-deploy operation, leading to remote code execution. The url field is also written unescaped, allowing HTML injection.
- CVE-2026-56660Critical
In GetSimple CMS CE prior to version 1.5, the update handler in UpdateCE.php downloads a ZIP archive and extracts it into the web root without validating file types or extraction paths. Because PHP files are written into a web-accessible directory, an attacker who can cause a malicious archive to be processed achieves remote code execution as the web-server user. Entry names are also used unsafely, allowing directory traversal (../) to write files outside the intended directory.
- CVE-2026-14984Critical
Teledyne FLIR Aware2 versions through 6.9.0.2 transmit data in cleartext in primary control endpoints. Remote unauthenticated attackers can intercept, hijack, or modify session traffic against PackBot robots via sniffing or hijacking network traffic.
- CVE-2026-104286CriticalActively exploited
A path traversal vulnerability in Fortinet FortiMail (versions 8.0.0-8.0.1, 7.6.0-7.6.6, 7.4.0-7.4.8, 7.2.0-7.2.9) stems from improper limitation of a pathname to a restricted directory. An unauthenticated attacker can write arbitrary files on the underlying system via crafted HTTP or HTTPS requests.
- CVE-2026-102628Critical
The Cadmos LTI application hosted at cadmos.eummena.io had Laravel debug mode enabled (APP_DEBUG=true, APP_ENV=local) in a publicly accessible environment. An unauthenticated attacker could send a GET request and trigger an unhandled exception, causing Laravel to expose the entire server environment, including all .env configuration variables, in plaintext. Fixed on or before 2026-09-02.
- CVE-2026-55083Critical
DHIS2 versions from 2.42.0 to before 2.42.5.1, and from 2.43.0 to before 2.43.0.1, are vulnerable to remote code execution (RCE) via unsafe Java deserialization. This issue has been patched in versions 2.42.5.1, 2.43.0.1, and 2.44.
Original NVD description (English source)
Command injection in the <redacted> parameter of a <redacted>.exe request leads to remote code execution as the root user. This issue affects Iocharger firmware for AC models before version 24120701. Likelihood: Moderate – This action is not a common place for command injection vulnerabilities to occur. Thus, an attacker will likely only be able to find this vulnerability by reverse-engineering the firmware or trying it on all <redacted> fields. The attacker will also need a (low privilege) account to gain access to the <redacted> binary, or convince a user with such access to execute a payload. Impact: Critical – The attacker has full control over the charging station as the root user, and can arbitrarily add, modify and delete files and services. CVSS clarification. The attack can be executed over any network connection the station is listening to and serves the web interface (AV:N), and there are no additional security measure sin place that need to be circumvented (AC:L), the a
Vulnerability data from NVD (NIST) · CISA KEV · EPSS