CVEvulnerability

CVE-2024-44843

5.9 MEDIUM Published 2025-04-15 Modified 2026-06-17 Official page ↗

Status: Analyzed
Published: 2025-04-15
Last modified: 2026-06-17
Assigner: [email protected]
CVSS 3.1 (134c704f-9b21-4f2e-91b3-4a467353bcc0): 5.9 MEDIUM — CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:L/A:L
Weaknesses: CWE-287

Description

An issue in the web socket handshake process of SteVe v3.7.1 allows attackers to bypass authentication and execute arbitrary coammands via supplying crafted OCPP requests.

Affected configurations

• steve-community steve 3.7.1

Weakness · CWE (1)

CWE-287 Improper Authentication weakness

References

https://gist.github.com/Badranh/94359664799db6d4709871f0c353f476 Exploit, Third Party Advisory
https://github.com/steve-community/steve/blob/master/src/main/java/de/rwth/idsg/steve/ocpp/ws/OcppWebSocketHandshakeHandler.java Product
https://github.com/steve-community/steve/issues/1546 Issue Tracking

CVE-2024-44843

Description

Affected configurations

Related

Weakness · CWE (1)

References