DIVD-2024-00035 - 17 vulnerabilities in Iocharger devices

Summary

Security researcher Wilco van Beijnum assisted by DIVD researcher Harm van den Brink has found 17 vulnerabilities in Iocharger AC products, which alone or in combination can lead to a full device compromise.

Iocharger has fixed the following 16 vulnerabilities:

• CVE-2024-43648 - Authenticated command injection via <redacted>.exe <redacted> parameter - CVSSv4 9.3
• CVE-2024-43649 - Authenticated command injection via <redacted>.exe <redacted> parameter - CVSSv4 9.3
• CVE-2024-43650 - Authenticated command injection in the <redacted> action leads to full remote code execution as root on the charging station - CVSSv4 9.3
• CVE-2024-43651 - Authenticated command injection in the <redacted> action leads to full remote code execution as root on the charging station - CVSSv4 9.3
• CVE-2024-43652 - Authenticated command injection in the <redacted> action leads to full remote code execution as root on the charging station - CVSSv4 9.3
• CVE-2024-43653 - Authenticated command injection in the <redacted> action leads to full remote code execution as root on the charging station - CVSSv4 9.3
• CVE-2024-43654 - Authenticated command injection in the <redacted> action leads to full remote code execution as root on the charging station - CVSSv4 9.3
• CVE-2024-43655 - Any authenticated users can execute OS commands as root using the <redacted>.sh CGI script. - CVSSv4 9.3
• CVE-2024-43656 - A backup can be manipulated and then restored to create arbitrary files inside the <redacted> directory. A CGI script can be added to the web directory this way, allowing for full remote code execution. - CVSSv4 9.3
• CVE-2024-43657 - When uploading new firmware, a shell script inside a firmware file is executed during its processing. This can be used to craft a custom firmware file with a custom script with arbitrary code, which will then be executed on the charging station. - CVSSv4 9.3
• CVE-2024-43658 - Using the <redacted> action or <redacted>.sh script, arbitrary files and directories can be deleted using directory traversal. - CVSSv4 7.2
• CVE-2024-43659 - Plaintext default credentials in firmware - CVSSv4 8.3
• CVE-2024-43660 - Arbitrary file download using <redacted>.sh - CVSSv4 7.1
• CVE-2024-43661 - Buffer overflow in <redacted>.so leads to DoS of OCPP service - CVSSv4 7.1
• CVE-2024-43662 - Authenticated arbitrary file upload to /tmp/ and /tmp/upload/ - CVSSv4 5.3
• CVE-2024-43663 - Buffer overflow vulnerabilities in CGI scripts lead to segfault - CVSSv4 5.3

Although all attacks are authenticated, an attacker that is in possession of a device or firmware image is able to extract all information needed to execute these attacks on other devices. Successful exploitation will give an attacker the ability to take full control over any device it can gain access to, either remotely via the internet, by being on the same (visitor) network as the charger.

The vendor reports that firmware version 24120701 fixes 13 of these vulnerabilities, and version 25010801 which fixes another 3. One vulnerability is currently still being fixed by the vendor.

What you can do

The vulnerabilities have been fixed in firmware version 24120701, and 25010801 which are applicable to all AC Chargers manufactured by Iocharger. Iocharger does not have a website where firmware can be downloaded or where it publishes release notes or security bulletins. Instead Iocharger has made their distributor(s) aware that firmware updates are available that fix security findings, and has urged them to install it on customers’ hardware. If as an owner you have not been contacted by your distributor/vendor we advice you to reach out to them for updated firmware. If you cannot get support from your vendor/distributor you can contact Iocharger directly on sales@iocharger.com to get updated firmware.

Because Iocharger uses weak default passwords that can relatively easily be extracted from the firmware, we also advice you change the passwords of all accounts immediately.

Additionally we recommend that you to make sure that any Iocharger device is not reachable from either the internet or any other untrusted network (e.g. a visitor network).

What we are doing

DIVD has responsibly disclosed 17 vulnerabilities to Iocharger, who have fixed 16 of these vulnerabilities and are still working on fixing the last one. Updated firmware is made available to their distributors. Now that these vulnerabilities have been published, we are scanning the internet to identify these devices and warn owners or network administrators that these devices are vulnerable and need to be updated via their suppliers.

We will continue to work with Iocharger to get the remaining vulnerabilities fixed.

Timeline

More information

• Iocharger website
• Product Website
• Blog post: Wilco van Beijnum and Harm van den Brink found 17 vulnerabilities in Iocharger EV chargers
• CVE-2024-43648
• CVE-2024-43649
• CVE-2024-43650
• CVE-2024-43651
• CVE-2024-43652
• CVE-2024-43653
• CVE-2024-43655
• CVE-2024-43656
• CVE-2024-43657
• CVE-2024-43660
• CVE-2024-43661
• CVE-2024-43662
• CVE-2024-43663