{"resultsPerPage":1,"startIndex":0,"totalResults":1,"format":"NVD_CVE","version":"2.0","timestamp":"2026-04-18T12:52:08.062","vulnerabilities":[{"cve":{"id":"CVE-2024-43655","sourceIdentifier":"csirt@divd.nl","published":"2025-01-09T08:15:28.300","lastModified":"2026-04-15T00:35:42.020","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability allows OS Command Injection as root\n\nThis issue affects Iocharger firmware for AC model chargers before version 24120701.\n\nLikelihood: Moderate – The attacker will first need to find the name of the script, and needs a (low privilege) account to gain access to the script, or convince a user with such access to execute a request to it.\n\nImpact: Critical – The attacker has full control over the charging station as the root user, and can arbitrarily add, modify and deletefiles and services.\n\nCVSS clarification: Any network interface serving the web ui is vulnerable (AV:N) and there are not additional security measures to circumvent (AC:L), nor does the attack require and existing preconditions (AT:N). The attack is authenticated, but the level of authentication does not matter (PR:L), nor is any user interaction required (UI:N). The attack leads to a full compromised (VC:H/VI:H/VA:H), and compromised devices can be used to pivot into networks that should potentially not be accessible (SC:L/SI:L/SA:H). Becuase this is an EV charger handing significant power, there is a potential safety impact (S:P). This attack can be automated (AU:Y)."},{"lang":"es","value":"Vulnerabilidad de neutralización incorrecta de elementos especiales utilizados en un comando ('Inyección de comando') permite la inyección de comandos del sistema operativo como superusuario este problema afecta al firmware de Iocharger para cargadores modelo AC anteriores a la versión 24120701. Probabilidad: moderada: el atacante primero deberá encontrar el nombre del script y necesita una cuenta (con poco nivel de privilegios) para obtener acceso al script o convencer a un usuario con dicho acceso para que ejecute una solicitud. Impacto: crítico: el atacante tiene control total sobre la estación de carga como usuario superusuario y puede agregar, modificar y eliminar archivos y servicios de forma arbitraria. Aclaración de CVSS: cualquier interfaz de red que sirva a la interfaz de usuario web es vulnerable (AV:N) y no hay medidas de seguridad adicionales para eludir (AC:L), ni el ataque requiere condiciones previas existentes (AT:N). El ataque está autenticado, pero el nivel de autenticación no importa (PR:L), ni se requiere ninguna interacción del usuario (UI:N). El ataque provoca una vulnerabilidad total (VC:H/VI:H/VA:H), y los dispositivos afectados pueden utilizarse para acceder a redes que potencialmente no deberían ser accesibles (SC:L/SI:L/SA:H). Como se trata de un cargador de vehículos eléctricos que gestiona una cantidad importante de energía, existe un posible impacto en la seguridad (S:P). Este ataque puede automatizarse (AU:Y)."}],"metrics":{"cvssMetricV40":[{"source":"csirt@divd.nl","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:P/AU:Y/R:X/V:X/RE:X/U:X","baseScore":9.3,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"LOW","subIntegrityImpact":"LOW","subAvailabilityImpact":"HIGH","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"PRESENT","Automatable":"YES","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}]},"weaknesses":[{"source":"csirt@divd.nl","type":"Secondary","description":[{"lang":"en","value":"CWE-78"},{"lang":"en","value":"CWE-250"}]}],"references":[{"url":"https://csirt.divd.nl/CVE-2024-43655/","source":"csirt@divd.nl"},{"url":"https://csirt.divd.nl/DIVD-2024-00035/","source":"csirt@divd.nl"},{"url":"https://iocharger.com","source":"csirt@divd.nl"}]}}]}