CVE-2024-11666

Unauthenticated Remote Command Injection in eCharge Salia PLCC

State: Published
Severity: 9.0 Critical
Published: Nov 24, 2024
Updated: Nov 25, 2024
Reserved: Nov 24, 2024

Description

Affected devices beacon to eCharge cloud infrastructure asking if there are any command they should run. This communication is established over an insecure channel since peer verification is disabled everywhere. Therefore, remote unauthenticated users suitably positioned on the network between an EV charger controller and eCharge infrastructure can execute arbitrary commands with elevated privileges on affected devices.

This issue affects cph2_echarge_firmware: through 2.0.4.

Scores

CVSS	Score	Vector	Source
3.1	9.0 Critical	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H	ONEKEY

Weaknesses

CWE-345 Insufficient Verification of Data Authenticity

Affected Products

Product	Versions
cph2_echarge_firmwarehardy-barth	2.0.4 and earlierAffected

References

https://www.onekey.com/resource/critical-vulnerabilities-in-ev-charging-stations-analysis-of-echarge-controllersthird-party-advisory

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.