Mennekes Smart - charging stations full disclosure

16 Jul 2026 - Victor Pasman

DIVD received a vulnerability report about the firmware of Mennekes Smart charging stations. The vulnerabilities were discovered by Wilco van Beijnum and analysed together with DIVD researchers Harm van den Brink and Frank Breedijk.

During an investigation of the Mennekes charging station, several vulnerabilities were found that allow an authenticated attacker to execute arbitrary OS commands on the charging station (as root), read arbitrary files from the filesystem, and manipulate the SQLite databases used by the device. Under the upcoming NIS2 regulations, charging infrastructure is considered critical infrastructure, which underlines the importance of these findings.

DIVD is a CVE Numbering Authority (CNA) and has used these rights to assign the following CVEs to the vulnerabilities included in the write-up below:

All five vulnerabilities affect Mennekes Smart charging stations running firmware prior to version 2.15 and are resolved in firmware 2.15 The rest of this post contains the full technical write-up of each vulnerability.

Command injection in firmware upgrade via URL - CVE-2025-22366

The “firmware upgrade via URL” field in the configuration web interface does not properly neutralise OS command characters before the value is passed to the underlying operating system. An authenticated attacker can abuse this field to execute arbitrary commands as root. The vulnerable functionality is reached via http://<ip-address>/, then Setup → ACU Update (via File-Upload) → URL. The URL field is vulnerable to command injection, for example using the following payload:

http://127.0.0.1/; <command>; abc

Risk Impact: Critical — the attacker gains full control over the charging station as the root user and can arbitrarily add, modify and delete files and services.

Suggested actions

Upgrade to firmware 2.15 or later. Use input filtering and escaping to prevent command injection, avoid passing user-controlled input to a shell, and do not run the web server as root.

Command injection in manually setting the time - CVE-2025-22367

The request used to manually set the time of the charging station does not properly neutralise OS command characters, allowing an authenticated attacker to obtain remote code execution through command injection. Manually changing the time sends a POST request to http://<ip-address>/admin/admin_netzwerk. The request can be manipulated with the following payload (basic authentication credentials must also be supplied):

timesource=manually&time_toggle=&from_year=<year>&from_month=<month>&from_day=<day>&from_hour=<hour>&from_minute=<minute>'%3b+<URL-encoded-command>%3b+echo+-n+'&time_button=

Risk Impact: Critical — the attacker gains full control over the charging station as the root user and can arbitrarily add, modify and delete files and services.

Suggested actions Upgrade to firmware 2.15 or later. Use input filtering and escaping to prevent command injection, avoid passing user-controlled input to a shell, and do not run the web server as root.

Command injection in SCU firmware update - CVE-2025-22368

The authenticated SCU firmware update command does not properly neutralise OS command characters, allowing an attacker to inject OS commands and gain remote code execution. OS commands can be injected by sending a POST request to http://<ip-address>/admin/admin_scu_do_fw_update. The request can be manipulated with the following payload (basic authentication credentials must also be supplied):

scu_id=1&typ=remote&target=abc%3b+<URL-encoded-command>%3b+abcd

Risk Impact: Critical — the attacker gains full control over the charging station as the root user and can arbitrarily add, modify and delete files and services.

Suggested actions

Upgrade to firmware 2.15 or later. Use input filtering and escaping to prevent command injection, avoid passing user-controlled input to a shell, and do not run the web server as root.

Arbitrary file download using ReadFile endpoint - CVE-2025-22369

The /admin/admin_ReadFile endpoint can be abused to read arbitrary files from the underlying operating system. An authenticated attacker can retrieve any file the web service can access. Arbitrary files can be downloaded by sending a POST request to /admin/admin_ReadFile with the following body (basic authentication credentials must also be supplied):

filename=<path-to-file>

Risk Impact: High — the endpoint can download any file on the filesystem, including sensitive files such as /etc/shadow, as well as the scripts and binaries running on the charging station.

Suggested actions

Upgrade to firmware 2.15 or later. It should not be possible for (low-privilege) users to download arbitrary files.

SQL injection in web configuration interface fields - CVE-2025-22370

Several fields in the web configuration interface insufficiently neutralise input, allowing an authenticated attacker to execute arbitrary SQL commands against the SQLite databases used by the interface. As an example, the “add user to whitelist” function is vulnerable. Entering an alias of '||SQLITE_VERSION()||' (the maxlength attribute on the alias field can be removed via the browser developer tools to fit the query) demonstrates the flaw: if injection is present, || is interpreted as string concatenation and the stored alias becomes the SQLite version used by the server. On the tested device this returned version 3.7.3, confirming the input was interpreted rather than stored literally. A code review of the interface’s Python scripts — obtained via the command-injection vulnerabilities described above — revealed many further injection points. These can be located by searching PersistentStorage_Manager.py for the regular expression cursor.*\(.*%s, which matches database queries built with string formatting.

Risk Impact: Moderate — the attacker can read and manipulate the SQLite databases used by the web interface. The impact is limited because the injection points only allow manipulation of the existing statement rather than execution of multiple/arbitrary statements. It may still be possible to retrieve sensitive information, bypass field filtering, and manipulate or break the functioning of the web configuration interface.

Suggested actions

Upgrade to firmware 2.15 or later. Use prepared statements and input filtering to prevent SQL injection.

References

Last modified: 04 Aug 2026 17:21 CEST