CVEvulnerability

CVE-2024-11666

9.8 CRITICAL Published 2024-11-24 Modified 2026-06-17 Official page ↗
Status
Analyzed
Published
2024-11-24
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
9.0 CRITICAL — CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
CVSS 3.1 ([email protected])
9.8 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-345

Description

Affected devices beacon to eCharge cloud infrastructure asking if there are any command they should run. This communication is established over an insecure channel since peer verification is disabled everywhere. Therefore, remote unauthenticated users  suitably positioned on the network between an EV charger controller and eCharge infrastructure can execute arbitrary commands with elevated privileges on affected devices. This issue affects cph2_echarge_firmware: through 2.0.4.

Affected configurations

• echarge salia plcc firmware (<= 2.0.4)

Related

Weakness · CWE (1)

  • CWE-345 Insufficient Verification of Data Authenticity weakness

References