An unauthenticated local attacker can inject a command that is subsequently executed as root, leading to a privilege escalation.

An unauthenticated local attacker can inject a command that is subsequently executed as root, leading to a privilege escalation.

An unauthenticated adjacent attacker can modify configuration by sending specific requests to an API-endpoint resulting in read and write access due to missing authentication. An unauthenticated local attacker can inject a command that is subsequently executed as root, leading to a privilege escalation. An unauthenticated remote attacker can alter the device configuration in a way to get remote code execution as root with specific configurations. An unauthenticated adjacent attacker is able to configure a new OCPP backend, due to insecure defaults for the configuration interface.