https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 07 Oct 2026 04:20:34 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-221762 EUVD-2026-221762 https://cve.radiocsirt.org/vuln/euvd-2026-221762 https://cve.radiocsirt.org/vuln/fkie_cve-2024-43648 <p>Command injection in the &lt;redacted&gt; parameter of a &lt;redacted&gt;.exe request leads to remote code execution as the root user.</p> <p>This issue affects Iocharger firmware for AC models before version 24120701.</p> <p>Likelihood: Moderate – This action is not a common place for command injection vulnerabilities to occur. Thus, an attacker will likely only be able to find this vulnerability by reverse-engineering the firmware or trying it on all &lt;redacted&gt; fields. The attacker will also need a (low privilege) account to gain access to the &lt;redacted&gt; binary, or convince a user with such access to execute a payload.</p> <p>Impact: Critical – The attacker has full control over the charging station as the root user, and can arbitrarily add, modify and delete files and services.</p> <p>CVSS clarification. The attack can be executed over any network connection the station is listening to and serves the web interface (AV:N), and there are no additional security measure sin place that need to be circumvented (AC:L), the attack does not rely on preconditions (AT:N). The attack does require authentication, but the level of authentication is irrelevant (PR:L), it does not require user interaction (UI:N). If is a full system compromise, potentially fully compromising confidentiality, integrity and availability of the devicer (VC:H/VI:H/VA:H).  A compromised charger can be used to &#34;pivot&#34; onto networks that should otherwise be closed, cause a low confidentiality and interity impact on subsequent systems. (SC:L/SI:L/…</p> <p>Command injection in the &lt;redacted&gt; parameter of a &lt;redacted&gt;.exe request leads to remote code execution as the root user.</p> <p>This issue affects Iocharger firmware for AC models before version 24120701.</p> <p>Likelihood: Moderate – This action is not a common place for command injection vulnerabilities to occur. Thus, an attacker will likely only be able to find this vulnerability by reverse-engineering the firmware or trying it on all &lt;redacted&gt; fields. The attacker will also need a (low privilege) account to gain access to the &lt;redacted&gt; binary, or convince a user with such access to execute a payload.</p> <p>Impact: Critical – The attacker has full control over the charging station as the root user, and can arbitrarily add, modify and delete files and services.</p> <p>CVSS clarification. The attack can be executed over any network connection the station is listening to and serves the web interface (AV:N), and there are no additional security measure sin place that need to be circumvented (AC:L), the attack does not rely on preconditions (AT:N). The attack does require authentication, but the level of authentication is irrelevant (PR:L), it does not require user interaction (UI:N). If is a full system compromise, potentially fully compromising confidentiality, integrity and availability of the devicer (VC:H/VI:H/VA:H).  A compromised charger can be used to &#34;pivot&#34; onto networks that should otherwise be closed, cause a low confidentiality and interity impact on subsequent systems. (SC:L/SI:L/…</p> https://cve.radiocsirt.org/vuln/fkie_cve-2024-43648 https://cve.radiocsirt.org/vuln/ghsa-r3r4-jc6c-965m <p>Command injection in the &lt;redacted&gt; parameter of a &lt;redacted&gt;.exe request leads to remote code execution as the root user.</p> <p>This issue affects Iocharger firmware for AC models before version 24120701.</p> <p>Likelihood: Moderate – This action is not a common place for command injection vulnerabilities to occur. Thus, an attacker will likely only be able to find this vulnerability by reverse-engineering the firmware or trying it on all &lt;redacted&gt; fields. The attacker will also need a (low privilege) account to gain access to the &lt;redacted&gt; binary, or convince a user with such access to execute a payload.</p> <p>Impact: Critical – The attacker has full control over the charging station as the root user, and can arbitrarily add, modify and delete files and services.</p> <p>CVSS clarification. The attack can be executed over any network connection the station is listening to and serves the web interface (AV:N), and there are no additional security measure sin place that need to be circumvented (AC:L), the attack does not rely on preconditions (AT:N). The attack does require authentication, but the level of authentication is irrelevant (PR:L), it does not require user interaction (UI:N). If is a full system compromise, potentially fully compromising confidentiality, integrity and availability of the devicer (VC:H/VI:H/VA:H).  A compromised charger can be used to &#34;pivot&#34; onto networks that should otherwise be closed, cause a low confidentiality and interity impact on subsequent systems. (SC:L/SI:L/…</p> <p>Command injection in the &lt;redacted&gt; parameter of a &lt;redacted&gt;.exe request leads to remote code execution as the root user.</p> <p>This issue affects Iocharger firmware for AC models before version 24120701.</p> <p>Likelihood: Moderate – This action is not a common place for command injection vulnerabilities to occur. Thus, an attacker will likely only be able to find this vulnerability by reverse-engineering the firmware or trying it on all &lt;redacted&gt; fields. The attacker will also need a (low privilege) account to gain access to the &lt;redacted&gt; binary, or convince a user with such access to execute a payload.</p> <p>Impact: Critical – The attacker has full control over the charging station as the root user, and can arbitrarily add, modify and delete files and services.</p> <p>CVSS clarification. The attack can be executed over any network connection the station is listening to and serves the web interface (AV:N), and there are no additional security measure sin place that need to be circumvented (AC:L), the attack does not rely on preconditions (AT:N). The attack does require authentication, but the level of authentication is irrelevant (PR:L), it does not require user interaction (UI:N). If is a full system compromise, potentially fully compromising confidentiality, integrity and availability of the devicer (VC:H/VI:H/VA:H).  A compromised charger can be used to &#34;pivot&#34; onto networks that should otherwise be closed, cause a low confidentiality and interity impact on subsequent systems. (SC:L/SI:L/…</p> https://cve.radiocsirt.org/vuln/ghsa-r3r4-jc6c-965m