CVE-2025-22367

Mennekes smart/premium charges systems, Command injection in time setting

State: Published
Severity: 8.7 High
Published: Mar 11, 2025
Updated: Apr 1, 2025
Reserved: Jan 3, 2025

Description

The authenticated time setting capability of the firmware for Mennekes Smart / Premium Chargingpoints can be abused for command execution because OS command are improperly neutralized when certain fields are passed to the underlying OS.

Scores

CVSS	Score	Vector	Source
4.0	8.7 High	CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:L/SI:N/SA:N/S:N/AU:Y	DIVD

Weaknesses

CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
CWE-250

Affected Products

Product	Versions
Smart / Premium charging stationsMennekes	before 2.15Affected

References

https://csirt.divd.nl/CVE-2025-22367third-party-advisory
https://csirt.divd.nl/DIVD-2025-00003vendor-advisory
https://www.mennekes.nl/fileadmin/MEN-Deutschland/emobility/04_software/06_smart_premium/Release_Notes_for_2.15_06.03.2025.pdfrelease-notes

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.