{"resultsPerPage":25,"startIndex":0,"totalResults":25,"format":"NVD_CVE","version":"2.0","timestamp":"2026-10-12T17:48:02.486","vulnerabilities":[{"cve":{"id":"CVE-2005-2856","sourceIdentifier":"cve@mitre.org","published":"2005-09-08T10:03:00.000","lastModified":"2026-06-16T22:15:47.620","vulnStatus":"Modified","cveTags":[],"descriptions":[{"lang":"en","value":"Stack-based buffer overflow in the WinACE UNACEV2.DLL third-party compression utility before 2.6.0.0, as used in multiple products including (1) ALZip 5.51 through 6.11, (2) Servant Salamander 2.0 and 2.5 Beta 1, (3) WinHKI 1.66 and 1.67, (4) ExtractNow 3.x, (5) Total Commander 6.53, (6) Anti-Trojan 5.5.421, (7) PowerArchiver before 9.61, (8) UltimateZip 2.7,1, 3.0.3, and 3.1b, (9) Where Is It (WhereIsIt) 3.73.501, (10) FilZip 3.04, (11) IZArc 3.5 beta3, (12) Eazel 1.0, (13) Rising Antivirus 18.27.21 and earlier, (14) AutoMate 6.1.0.0, (15) BitZipper 4.1 SR-1, (16) ZipTV, and other products, allows user-assisted attackers to execute arbitrary code via a long filename in an ACE archive."}],"affected":[{"source":"cve@mitre.org","affectedData":[{"vendor":"n/a","product":"n/a","versions":[{"version":"n/a","status":"affected"}]}]}],"metrics":{"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:P/I:P/A:P","baseScore":7.5,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"},"baseSeverity":"HIGH","exploitabilityScore":10.0,"impactScore":6.4,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":true,"obtainOtherPrivilege":false,"userInteractionRequired":false}]},"weaknesses":[{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"CWE-119"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:winace:winace:2.6.0.0:*:*:*:*:*:*:*","matchCriteriaId":"64D2B1B2-B49D-4F22-B4C6-CE0FAF0FDF35"}]}]}],"references":[{"url":"http://marc.info/?l=bugtraq&m=112621008228458&w=2","source":"cve@mitre.org"},{"url":"http://secunia.com/advisories/16479","source":"cve@mitre.org","tags":["Patch","Vendor Advisory"]},{"url":"http://secunia.com/advisories/19454","source":"cve@mitre.org","tags":["Vendor Advisory"]},{"url":"http://secunia.com/advisories/19458","source":"cve@mitre.org","tags":["Vendor Advisory"]},{"url":"http://secunia.com/advisories/19581","source":"cve@mitre.org","tags":["Vendor Advisory"]},{"url":"http://secunia.com/advisories/19596","source":"cve@mitre.org"},{"url":"http://secunia.com/advisories/19612","source":"cve@mitre.org"},{"url":"http://secunia.com/advisories/19834","source":"cve@mitre.org","tags":["Vendor Advisory"]},{"url":"http://secunia.com/advisories/19890","source":"cve@mitre.org","tags":["Vendor Advisory"]},{"url":"http://secunia.com/advisories/19931","source":"cve@mitre.org"},{"url":"http://secunia.com/advisories/19938","source":"cve@mitre.org","tags":["Vendor Advisory"]},{"url":"http://secunia.com/advisories/19939","source":"cve@mitre.org"},{"url":"http://secunia.com/advisories/19967","source":"cve@mitre.org","tags":["Vendor Advisory"]},{"url":"http://secunia.com/advisories/19975","source":"cve@mitre.org","tags":["Vendor Advisory"]},{"url":"http://secunia.com/advisories/19977","source":"cve@mitre.org","tags":["Vendor Advisory"]},{"url":"http://secunia.com/advisories/20009","source":"cve@mitre.org","tags":["Vendor Advisory"]},{"url":"http://secunia.com/advisories/20270","source":"cve@mitre.org"},{"url":"http://secunia.com/secunia_research/2005-41/advisory/","source":"cve@mitre.org"},{"url":"http://secunia.com/secunia_research/2006-24/advisory","source":"cve@mitre.org","tags":["Vendor Advisory"]},{"url":"http://secunia.com/secunia_research/2006-25/advisory","source":"cve@mitre.org","tags":["Vendor Advisory"]},{"url":"http://secunia.com/secunia_research/2006-27/","source":"cve@mitre.org","tags":["Vendor Advisory"]},{"url":"http://secunia.com/secunia_research/2006-28/advisory","source":"cve@mitre.org","tags":["Vendor Advisory"]},{"url":"http://secunia.com/secunia_research/2006-29/advisory/","source":"cve@mitre.org","tags":["Vendor Advisory"]},{"url":"http://secunia.com/secunia_research/2006-30/advisory","source":"cve@mitre.org","tags":["Vendor Advisory"]},{"url":"http://secunia.com/secunia_research/2006-32/advisory/","source":"cve@mitre.org"},{"url":"http://secunia.com/secunia_research/2006-33/advisory/","source":"cve@mitre.org","tags":["Vendor Advisory"]},{"url":"http://secunia.com/secunia_research/2006-36/advisory","source":"cve@mitre.org","tags":["Vendor Advisory"]},{"url":"http://secunia.com/secunia_research/2006-38/advisory","source":"cve@mitre.org","tags":["Vendor Advisory"]},{"url":"http://secunia.com/secunia_research/2006-46/advisory/","source":"cve@mitre.org"},{"url":"http://secunia.com/secunia_research/2006-50/advisory/","source":"cve@mitre.org"},{"url":"http://securityreason.com/securityalert/49","source":"cve@mitre.org"},{"url":"http://securitytracker.com/id?1014863","source":"cve@mitre.org"},{"url":"http://securitytracker.com/id?1015852","source":"cve@mitre.org"},{"url":"http://securitytracker.com/id?1016011","source":"cve@mitre.org"},{"url":"http://securitytracker.com/id?1016012","source":"cve@mitre.org"},{"url":"http://securitytracker.com/id?1016065","source":"cve@mitre.org"},{"url":"http://securitytracker.com/id?1016066","source":"cve@mitre.org"},{"url":"http://securitytracker.com/id?1016088","source":"cve@mitre.org"},{"url":"http://securitytracker.com/id?1016114","source":"cve@mitre.org"},{"url":"http://securitytracker.com/id?1016115","source":"cve@mitre.org"},{"url":"http://securitytracker.com/id?1016177","source":"cve@mitre.org"},{"url":"http://securitytracker.com/id?1016257","source":"cve@mitre.org"},{"url":"http://securitytracker.com/id?1016512","source":"cve@mitre.org"},{"url":"http://www.osvdb.org/25129","source":"cve@mitre.org"},{"url":"http://www.securityfocus.com/archive/1/432357/100/0/threaded","source":"cve@mitre.org"},{"url":"http://www.securityfocus.com/archive/1/432579/100/0/threaded","source":"cve@mitre.org"},{"url":"http://www.securityfocus.com/archive/1/433258/100/0/threaded","source":"cve@mitre.org"},{"url":"http://www.securityfocus.com/archive/1/433352/100/0/threaded","source":"cve@mitre.org"},{"url":"http://www.securityfocus.com/archive/1/433693/100/0/threaded","source":"cve@mitre.org"},{"url":"http://www.securityfocus.com/archive/1/434011/100/0/threaded","source":"cve@mitre.org"},{"url":"http://www.securityfocus.com/archive/1/434234/100/0/threaded","source":"cve@mitre.org"},{"url":"http://www.securityfocus.com/archive/1/434279/100/0/threaded","source":"cve@mitre.org"},{"url":"http://www.securityfocus.com/archive/1/436639/100/0/threaded","source":"cve@mitre.org"},{"url":"http://www.securityfocus.com/archive/1/440303/100/0/threaded","source":"cve@mitre.org"},{"url":"http://www.securityfocus.com/bid/14759","source":"cve@mitre.org"},{"url":"http://www.securityfocus.com/bid/19884","source":"cve@mitre.org"},{"url":"http://www.vupen.com/english/advisories/2006/1565","source":"cve@mitre.org"},{"url":"http://www.vupen.com/english/advisories/2006/1577","source":"cve@mitre.org"},{"url":"http://www.vupen.com/english/advisories/2006/1611","source":"cve@mitre.org"},{"url":"http://www.vupen.com/english/advisories/2006/1681","source":"cve@mitre.org"},{"url":"http://www.vupen.com/english/advisories/2006/1694","source":"cve@mitre.org"},{"url":"http://www.vupen.com/english/advisories/2006/1725","source":"cve@mitre.org"},{"url":"http://www.vupen.com/english/advisories/2006/1775","source":"cve@mitre.org"},{"url":"http://www.vupen.com/english/advisories/2006/1797","source":"cve@mitre.org"},{"url":"http://www.vupen.com/english/advisories/2006/1835","source":"cve@mitre.org"},{"url":"http://www.vupen.com/english/advisories/2006/1836","source":"cve@mitre.org"},{"url":"http://www.vupen.com/english/advisories/2006/2047","source":"cve@mitre.org"},{"url":"http://www.vupen.com/english/advisories/2006/2184","source":"cve@mitre.org"},{"url":"http://www.vupen.com/english/advisories/2006/2824","source":"cve@mitre.org"},{"url":"http://www.vupen.com/english/advisories/2006/3495","source":"cve@mitre.org"},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/26116","source":"cve@mitre.org"},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/26142","source":"cve@mitre.org"},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/26168","source":"cve@mitre.org"},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/26272","source":"cve@mitre.org"},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/26302","source":"cve@mitre.org"},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/26315","source":"cve@mitre.org"},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/26385","source":"cve@mitre.org"},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/26447","source":"cve@mitre.org"},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/26479","source":"cve@mitre.org"},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/26480","source":"cve@mitre.org"},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/26736","source":"cve@mitre.org"},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/26982","source":"cve@mitre.org"},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/27763","source":"cve@mitre.org"},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/28787","source":"cve@mitre.org"},{"url":"http://marc.info/?l=bugtraq&m=112621008228458&w=2","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://secunia.com/advisories/16479","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Patch","Vendor Advisory"]},{"url":"http://secunia.com/advisories/19454","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Vendor Advisory"]},{"url":"http://secunia.com/advisories/19458","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Vendor Advisory"]},{"url":"http://secunia.com/advisories/19581","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Vendor Advisory"]},{"url":"http://secunia.com/advisories/19596","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://secunia.com/advisories/19612","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://secunia.com/advisories/19834","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Vendor Advisory"]},{"url":"http://secunia.com/advisories/19890","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Vendor Advisory"]},{"url":"http://secunia.com/advisories/19931","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://secunia.com/advisories/19938","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Vendor Advisory"]},{"url":"http://secunia.com/advisories/19939","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://secunia.com/advisories/19967","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Vendor Advisory"]},{"url":"http://secunia.com/advisories/19975","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Vendor Advisory"]},{"url":"http://secunia.com/advisories/19977","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Vendor Advisory"]},{"url":"http://secunia.com/advisories/20009","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Vendor Advisory"]},{"url":"http://secunia.com/advisories/20270","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://secunia.com/secunia_research/2005-41/advisory/","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://secunia.com/secunia_research/2006-24/advisory","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Vendor Advisory"]},{"url":"http://secunia.com/secunia_research/2006-25/advisory","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Vendor Advisory"]},{"url":"http://secunia.com/secunia_research/2006-27/","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Vendor Advisory"]},{"url":"http://secunia.com/secunia_research/2006-28/advisory","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Vendor Advisory"]},{"url":"http://secunia.com/secunia_research/2006-29/advisory/","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Vendor Advisory"]},{"url":"http://secunia.com/secunia_research/2006-30/advisory","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Vendor Advisory"]},{"url":"http://secunia.com/secunia_research/2006-32/advisory/","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://secunia.com/secunia_research/2006-33/advisory/","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Vendor Advisory"]},{"url":"http://secunia.com/secunia_research/2006-36/advisory","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Vendor Advisory"]},{"url":"http://secunia.com/secunia_research/2006-38/advisory","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Vendor Advisory"]},{"url":"http://secunia.com/secunia_research/2006-46/advisory/","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://secunia.com/secunia_research/2006-50/advisory/","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://securityreason.com/securityalert/49","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://securitytracker.com/id?1014863","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://securitytracker.com/id?1015852","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://securitytracker.com/id?1016011","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://securitytracker.com/id?1016012","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://securitytracker.com/id?1016065","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://securitytracker.com/id?1016066","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://securitytracker.com/id?1016088","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://securitytracker.com/id?1016114","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://securitytracker.com/id?1016115","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://securitytracker.com/id?1016177","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://securitytracker.com/id?1016257","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://securitytracker.com/id?1016512","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://www.osvdb.org/25129","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://www.securityfocus.com/archive/1/432357/100/0/threaded","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://www.securityfocus.com/archive/1/432579/100/0/threaded","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://www.securityfocus.com/archive/1/433258/100/0/threaded","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://www.securityfocus.com/archive/1/433352/100/0/threaded","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://www.securityfocus.com/archive/1/433693/100/0/threaded","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://www.securityfocus.com/archive/1/434011/100/0/threaded","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://www.securityfocus.com/archive/1/434234/100/0/threaded","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://www.securityfocus.com/archive/1/434279/100/0/threaded","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://www.securityfocus.com/archive/1/436639/100/0/threaded","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://www.securityfocus.com/archive/1/440303/100/0/threaded","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://www.securityfocus.com/bid/14759","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://www.securityfocus.com/bid/19884","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://www.vupen.com/english/advisories/2006/1565","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://www.vupen.com/english/advisories/2006/1577","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://www.vupen.com/english/advisories/2006/1611","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://www.vupen.com/english/advisories/2006/1681","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://www.vupen.com/english/advisories/2006/1694","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://www.vupen.com/english/advisories/2006/1725","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://www.vupen.com/english/advisories/2006/1775","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://www.vupen.com/english/advisories/2006/1797","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://www.vupen.com/english/advisories/2006/1835","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://www.vupen.com/english/advisories/2006/1836","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://www.vupen.com/english/advisories/2006/2047","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://www.vupen.com/english/advisories/2006/2184","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://www.vupen.com/english/advisories/2006/2824","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://www.vupen.com/english/advisories/2006/3495","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/26116","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/26142","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/26168","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/26272","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/26302","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/26315","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/26385","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/26447","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/26479","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/26480","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/26736","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/26982","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/27763","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/28787","source":"af854a3a-2127-422b-91ae-364da2661108"}]}},{"cve":{"id":"CVE-2024-43479","sourceIdentifier":"secure@microsoft.com","published":"2024-09-10T17:15:35.830","lastModified":"2026-08-10T16:19:11.960","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Microsoft Power Automate Desktop Remote Code Execution Vulnerability"},{"lang":"es","value":"Vulnerabilidad de ejecución remota de código en Microsoft Power Automate Desktop"}],"affected":[{"source":"secure@microsoft.com","affectedData":[{"vendor":"Microsoft","product":"Power Automate for Desktop","versions":[{"version":"1.0.0.0","lessThan":"2.47.119.24249","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"secure@microsoft.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H","baseScore":8.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"LOW","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":6.0}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2024-09-10T18:38:04.310651Z","id":"CVE-2024-43479","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"secure@microsoft.com","type":"Secondary","description":[{"lang":"en","value":"CWE-284"}]},{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"NVD-CWE-noinfo"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:microsoft:power_automate:*:*:*:*:*:windows:*:*","versionStartIncluding":"2.41","versionEndExcluding":"2.41.178.24249","matchCriteriaId":"322F9991-B8B9-4663-A85F-5707690F7EC2"},{"vulnerable":true,"criteria":"cpe:2.3:a:microsoft:power_automate:*:*:*:*:*:windows:*:*","versionStartIncluding":"2.42","versionEndExcluding":"2.42.331.24249","matchCriteriaId":"474BAB62-900B-4E53-8806-6CF0A00A42C0"},{"vulnerable":true,"criteria":"cpe:2.3:a:microsoft:power_automate:*:*:*:*:*:windows:*:*","versionStartIncluding":"2.43","versionEndExcluding":"2.43.249.24249","matchCriteriaId":"5149B144-1E46-48C4-A0E4-D52A6FCBCF06"},{"vulnerable":true,"criteria":"cpe:2.3:a:microsoft:power_automate:*:*:*:*:*:windows:*:*","versionStartIncluding":"2.44","versionEndExcluding":"2.44.55.24249","matchCriteriaId":"E6EB212A-F877-4295-812A-3107CE292ED0"},{"vulnerable":true,"criteria":"cpe:2.3:a:microsoft:power_automate:*:*:*:*:*:windows:*:*","versionStartIncluding":"2.45","versionEndExcluding":"2.45.404.24249","matchCriteriaId":"1B0733C1-CA8E-444F-ABD8-C3764642E276"},{"vulnerable":true,"criteria":"cpe:2.3:a:microsoft:power_automate:*:*:*:*:*:windows:*:*","versionStartIncluding":"2.46","versionEndExcluding":"2.46.181.24249","matchCriteriaId":"9FEBB153-D701-4BE4-9711-51CFDE92AA74"},{"vulnerable":true,"criteria":"cpe:2.3:a:microsoft:power_automate:*:*:*:*:*:windows:*:*","versionStartIncluding":"2.47","versionEndExcluding":"2.47.119.24249","matchCriteriaId":"4F353C0E-6892-4A4A-AEA7-59A778ADC380"}]}]}],"references":[{"url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-43479","source":"secure@microsoft.com","tags":["Patch","Vendor Advisory"]}]}},{"cve":{"id":"CVE-2024-43648","sourceIdentifier":"csirt@divd.nl","published":"2025-01-09T08:15:26.980","lastModified":"2026-06-17T07:51:29.197","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Command injection in the parameter of a .exe request leads to remote code execution as the root user.\n\nThis issue affects Iocharger firmware for AC models before version 24120701.\n\nLikelihood: Moderate – This action is not a common place for command injection vulnerabilities to occur. Thus, an attacker will likely only be able to find this vulnerability by reverse-engineering the firmware or trying it on all fields. The attacker will also need a (low privilege) account to gain access to the binary, or convince a user with such access to execute a payload.\n\nImpact: Critical – The attacker has full control over the charging station as the root user, and can arbitrarily add, modify and delete files and services.\n\nCVSS clarification. The attack can be executed over any network connection the station is listening to and serves the web interface (AV:N), and there are no additional security measure sin place that need to be circumvented (AC:L), the attack does not rely on preconditions (AT:N). The attack does require authentication, but the level of authentication is irrelevant (PR:L), it does not require user interaction (UI:N). If is a full system compromise, potentially fully compromising confidentiality, integrity and availability of the devicer (VC:H/VI:H/VA:H).  A compromised charger can be used to \"pivot\" onto networks that should otherwise be closed, cause a low confidentiality and interity impact on subsequent systems. (SC:L/SI:L/SA:H). Because this device is an EV charger handing significant amounts of power, we suspect this vulnerability can have a safety impact (S:P). The attack can be automated (AU:Y)."},{"lang":"es","value":"La inyección de comandos en el parámetro de una solicitud .exe provoca la ejecución remota de código como usuario superusuario. Este problema afecta al firmware de Iocharger para modelos de aire acondicionado anteriores a la versión 24120701. Probabilidad: moderada: esta acción no es un lugar común para que se produzcan vulnerabilidades de inyección de comandos. Por lo tanto, es probable que un atacante solo pueda encontrar esta vulnerabilidad mediante ingeniería inversa del firmware o probándola en todos los campos . El atacante también necesitará una cuenta (con privilegios bajos) para obtener acceso al binario o convencer a un usuario con dicho acceso para que ejecute un payload. Impacto: crítico: el atacante tiene control total sobre la estación de carga como usuario root y puede agregar, modificar y eliminar archivos y servicios de forma arbitraria. Aclaración de CVSS. El ataque se puede ejecutar a través de cualquier conexión de red que la estación esté escuchando y que sirva a la interfaz web (AV:N), y no hay ninguna medida de seguridad adicional que se deba eludir (AC:L), el ataque no depende de condiciones previas (AT:N). El ataque requiere autenticación, pero el nivel de autenticación es irrelevante (PR:L), no requiere interacción del usuario (UI:N). Se trata de un compromiso total del sistema, que potencialmente compromete por completo la confidencialidad, integridad y disponibilidad del dispositivo (VC:H/VI:H/VA:H). Un cargador comprometido se puede utilizar para \"pivotar\" hacia redes que de otro modo deberían estar cerradas, lo que causa un impacto bajo en la confidencialidad e interidad de los sistemas posteriores (SC:L/SI:L/SA:H). Debido a que este dispositivo es un cargador EV que gestiona cantidades significativas de energía, sospechamos que esta vulnerabilidad puede tener un impacto en la seguridad (S:P). El ataque se puede automatizar (AU:Y)."}],"affected":[{"source":"csirt@divd.nl","affectedData":[{"vendor":"Iocharger","product":"Iocharger firmware for AC models","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"24120701","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"csirt@divd.nl","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:P/AU:Y/R:X/V:X/RE:X/U:X","baseScore":9.3,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"LOW","subIntegrityImpact":"LOW","subAvailabilityImpact":"HIGH","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"PRESENT","Automatable":"YES","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2025-01-09T14:45:36.579487Z","id":"CVE-2024-43648","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"csirt@divd.nl","type":"Secondary","description":[{"lang":"en","value":"CWE-78"},{"lang":"en","value":"CWE-250"}]}],"references":[{"url":"https://csirt.divd.nl/CVE-2024-43648/","source":"csirt@divd.nl"},{"url":"https://csirt.divd.nl/DIVD-2024-00035/","source":"csirt@divd.nl"},{"url":"https://iocharger.com","source":"csirt@divd.nl"}]}},{"cve":{"id":"CVE-2024-43650","sourceIdentifier":"csirt@divd.nl","published":"2025-01-09T08:15:27.417","lastModified":"2026-06-17T07:51:29.557","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in Iocharger firmware for AC models allows OS Command Injection as root\n\nThis issue affects  firmware versions before 24120701.\n\nLikelihood: Moderate – The binary does not seem to be used by the web interface, so it might be more difficult to find. It seems to be largely the same binary as used by the Iocharger Pedestal charging station, however. The attacker will also need a (low privilege) account to gain access to the binary, or convince a user with such access to execute a crafted HTTP request.\n\nImpact: Critical – The attacker has full control over the charging station as the root user, and can arbitrarily add, modify and delete\nfiles and services.\n\nCVSS clarification: The attack can be executed over any network connection serving the web interface (AV:N). There are no additional measures that need to be circumvented (AC:L) or attack preconditions (AT:N). THe attack is privileged, but the level does not matter (PR:L) and does not require user interaction (UI:N). Attack leads to full system compromised (VC:H/VI:H/VA:H) and compromised devices can be used to \"pivot\" to other networks that should be unreachable (SC:L/SI:L/SA:H). Because this an EV charger using high power, there is a potential safety impact (S:P). The attack can be automated (AU:Y)."},{"lang":"es","value":"Vulnerabilidad de neutralización incorrecta de elementos especiales utilizados en un comando ('Inyección de comando') en el firmware de Iocharger para modelos AC permite la inyección de comandos del sistema operativo como superusuario este problema afecta a las versiones de firmware anteriores a 24120701. Probabilidad: moderada: el binario no parece ser utilizado por la interfaz web, por lo que puede ser más difícil de encontrar. Sin embargo, parece ser en gran medida el mismo binario que utiliza la estación de carga Pedestal de Iocharger. El atacante también necesitará una cuenta (con privilegios bajos) para obtener acceso al binario o convencer a un usuario con dicho acceso para que ejecute una solicitud HTTP manipulada. Impacto: crítico: el atacante tiene control total sobre la estación de carga como usuario superusuario y puede agregar, modificar y eliminar archivos y servicios de forma arbitraria. Aclaración de CVSS: el ataque se puede ejecutar sobre cualquier conexión de red que sirva a la interfaz web (AV:N). No hay medidas adicionales que deban eludirse (AC:L) ni condiciones previas de ataque (AT:N). El ataque es privilegiado, pero el nivel no importa (PR:L) y no requiere la interacción del usuario (UI:N). El ataque provoca la vulneración total del sistema (VC:H/VI:H/VA:H) y los dispositivos vulnerados pueden utilizarse para \"pivotar\" hacia otras redes que deberían ser inaccesibles (SC:L/SI:L/SA:H). Debido a que se trata de un cargador de vehículos eléctricos que utiliza alta potencia, existe un posible impacto en la seguridad (S:P). El ataque puede automatizarse (AU:Y)."}],"affected":[{"source":"csirt@divd.nl","affectedData":[{"vendor":"Iocharger","product":"Iocharger firmware for AC models","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"24120701","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"csirt@divd.nl","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:P/AU:Y/R:X/V:X/RE:X/U:X","baseScore":9.3,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"LOW","subIntegrityImpact":"LOW","subAvailabilityImpact":"HIGH","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"PRESENT","Automatable":"YES","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2025-01-09T15:09:01.310561Z","id":"CVE-2024-43650","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"csirt@divd.nl","type":"Secondary","description":[{"lang":"en","value":"CWE-78"},{"lang":"en","value":"CWE-250"}]}],"references":[{"url":"https://csirt.divd.nl/CVE-2024-43650/","source":"csirt@divd.nl"},{"url":"https://csirt.divd.nl/DIVD-2024-00035/","source":"csirt@divd.nl"},{"url":"https://iocharger.com","source":"csirt@divd.nl"}]}},{"cve":{"id":"CVE-2024-43653","sourceIdentifier":"csirt@divd.nl","published":"2025-01-09T08:15:27.950","lastModified":"2026-06-17T07:51:29.990","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability  allows OS Command Injection as root\nThis issue affects Iocharger firmware for AC model chargers before version 24120701.\n\nLikelihood: Moderate – The binary does not seem to be used by the web interface, so it might be more difficult to find. It seems to be largely the same binary as used by the Iocharger Pedestal charging station, however. The attacker will also need a (low privilege) account to gain access to the binary, or convince a user with such access to execute a crafted HTTP request.\n\nImpact: Critical – The attacker has full control over the charging station as the root user, and can arbitrarily add, modify and delete\nfiles and services.\n\nCVSS clarification: Any network interface serving the web ui is vulnerable (AV:N) and there are not additional security measures to circumvent (AC:L), nor does the attack require and existing preconditions (AT:N). The attack is authenticated, but the level of authentication does not matter (PR:L), nor is any user interaction required (UI:N). The attack leads to a full compromised (VC:H/VI:H/VA:H), and compromised devices can be used to pivot into networks that should potentially not be accessible (SC:L/SI:L/SA:H). Becuase this is an EV charger handing significant power, there is a potential safety impact (S:P). This attack can be automated (AU:Y)."},{"lang":"es","value":"Vulnerabilidad de neutralización incorrecta de elementos especiales utilizados en un comando ('Inyección de comando') permite la inyección de comandos del sistema operativo como root Este problema afecta al firmware de Iocharger para cargadores modelo AC anteriores a la versión 24120701. Probabilidad: moderada: el binario no parece ser utilizado por la interfaz web, por lo que podría ser más difícil de encontrar. Sin embargo, parece ser en gran medida el mismo binario que utiliza la estación de carga Pedestal de Iocharger. El atacante también necesitará una cuenta (con privilegios bajos) para obtener acceso al binario o convencer a un usuario con dicho acceso para que ejecute una solicitud HTTP manipulada. Impacto: crítico: el atacante tiene control total sobre la estación de carga como usuario superusuario y puede agregar, modificar y eliminar archivos y servicios de forma arbitraria. Aclaración de CVSS: cualquier interfaz de red que sirva a la interfaz de usuario web es vulnerable (AV:N) y no hay medidas de seguridad adicionales para eludir (AC:L), ni el ataque requiere condiciones previas existentes (AT:N). El ataque está autenticado, pero el nivel de autenticación no importa (PR:L), ni se requiere interacción del usuario (UI:N). El ataque lleva a una vulnerabilidad total (VC:H/VI:H/VA:H), y los dispositivos afectados pueden usarse para ingresar a redes que potencialmente no deberían ser accesibles (SC:L/SI:L/SA:H). Debido a que se trata de un cargador de vehículos eléctricos que gestiona una cantidad significativa de energía, existe un posible impacto en la seguridad (S:P). Este ataque puede automatizarse (AU:Y)."}],"affected":[{"source":"csirt@divd.nl","affectedData":[{"vendor":"Iocharger","product":"Iocharger firmware for AC models","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"24120701","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"csirt@divd.nl","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:P/AU:Y/R:X/V:X/RE:X/U:X","baseScore":9.3,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"LOW","subIntegrityImpact":"LOW","subAvailabilityImpact":"HIGH","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"PRESENT","Automatable":"YES","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2025-01-09T14:39:24.235683Z","id":"CVE-2024-43653","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"csirt@divd.nl","type":"Secondary","description":[{"lang":"en","value":"CWE-78"},{"lang":"en","value":"CWE-250"}]}],"references":[{"url":"https://csirt.divd.nl/CVE-2024-43653/","source":"csirt@divd.nl"},{"url":"https://csirt.divd.nl/DIVD-2024-00035/","source":"csirt@divd.nl"},{"url":"https://iocharger.com","source":"csirt@divd.nl"}]}},{"cve":{"id":"CVE-2024-43654","sourceIdentifier":"csirt@divd.nl","published":"2025-01-09T08:15:28.127","lastModified":"2026-06-17T07:51:30.160","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in Iocharger firmware for AC models allows OS Command Injection as root\nThis issue affects all Iocharger AC EV charger models on a firmware version before 25010801.\n\nLikelihood: Moderate – The binary does not seem to be used by the web interface, so it might be more difficult to find. It seems to be largely the same binary as used by the Iocharger Pedestal charging station, however. The attacker will also need a (low privilege) account to gain access to the binary, or convince a user with such access to execute a crafted HTTP request.\n\nImpact: Critical – The attacker has full control over the charging station as the root user, and can arbitrarily add, modify and delete\nfiles and services.\n\nCVSS clarification: Any network interface serving the web ui is vulnerable (AV:N) and there are not additional security measures to circumvent (AC:L), nor does the attack require and existing preconditions (AT:N). The attack is authenticated, but the level of authentication does not matter (PR:L), nor is any user interaction required (UI:N). The attack leads to a full compromised (VC:H/VI:H/VA:H), and compromised devices can be used to pivot into networks that should potentially not be accessible (SC:L/SI:L/SA:H). Becuase this is an EV charger handing significant power, there is a potential safety impact (S:P). This attack can be automated (AU:Y)."},{"lang":"es","value":"Vulnerabilidad de neutralización incorrecta de elementos especiales utilizados en un comando ('Inyección de comando') en el firmware de Iocharger para modelos AC permite la inyección de comandos del sistema operativo como superusuario este problema afecta a todos los modelos de cargadores EV de CA de Iocharger en una versión de firmware anterior a 25010801. Probabilidad: moderada: el binario no parece ser utilizado por la interfaz web, por lo que podría ser más difícil de encontrar. Sin embargo, parece ser en gran medida el mismo binario que utiliza la estación de carga de pedestal Iocharger. El atacante también necesitará una cuenta (con poco nivel de privilegios) para obtener acceso al binario o convencer a un usuario con dicho acceso para que ejecute una solicitud HTTP manipulada. Impacto: crítico: el atacante tiene control total sobre la estación de carga como usuario superusuario y puede agregar, modificar y eliminar archivos y servicios de forma arbitraria. Aclaración de CVSS: cualquier interfaz de red que sirva a la interfaz de usuario web es vulnerable (AV:N) y no hay medidas de seguridad adicionales para eludirla (AC:L), ni el ataque requiere condiciones previas existentes (AT:N). El ataque está autenticado, pero el nivel de autenticación no importa (PR:L), ni se requiere interacción del usuario (UI:N). El ataque conduce a una vulneración total (VC:H/VI:H/VA:H), y los dispositivos vulnerados pueden usarse para ingresar a redes que potencialmente no deberían ser accesibles (SC:L/SI:L/SA:H). Debido a que se trata de un cargador de vehículos eléctricos que gestiona una cantidad significativa de energía, existe un posible impacto en la seguridad (S:P). Este ataque puede automatizarse (AU:Y)."}],"affected":[{"source":"csirt@divd.nl","affectedData":[{"vendor":"Iocharger","product":"Iocharger firmware for AC models","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"25010801","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"csirt@divd.nl","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:P/AU:Y/R:X/V:X/RE:X/U:X","baseScore":9.3,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"LOW","subIntegrityImpact":"LOW","subAvailabilityImpact":"HIGH","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"PRESENT","Automatable":"YES","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2025-01-09T14:32:43.409061Z","id":"CVE-2024-43654","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"csirt@divd.nl","type":"Secondary","description":[{"lang":"en","value":"CWE-78"},{"lang":"en","value":"CWE-250"}]}],"references":[{"url":"https://csirt.divd.nl/CVE-2024-43654/","source":"csirt@divd.nl"},{"url":"https://csirt.divd.nl/DIVD-2024-00035/","source":"csirt@divd.nl"},{"url":"https://iocharger.com","source":"csirt@divd.nl"}]}},{"cve":{"id":"CVE-2024-43655","sourceIdentifier":"csirt@divd.nl","published":"2025-01-09T08:15:28.300","lastModified":"2026-06-17T07:51:30.333","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability allows OS Command Injection as root\n\nThis issue affects Iocharger firmware for AC model chargers before version 24120701.\n\nLikelihood: Moderate – The attacker will first need to find the name of the script, and needs a (low privilege) account to gain access to the script, or convince a user with such access to execute a request to it.\n\nImpact: Critical – The attacker has full control over the charging station as the root user, and can arbitrarily add, modify and deletefiles and services.\n\nCVSS clarification: Any network interface serving the web ui is vulnerable (AV:N) and there are not additional security measures to circumvent (AC:L), nor does the attack require and existing preconditions (AT:N). The attack is authenticated, but the level of authentication does not matter (PR:L), nor is any user interaction required (UI:N). The attack leads to a full compromised (VC:H/VI:H/VA:H), and compromised devices can be used to pivot into networks that should potentially not be accessible (SC:L/SI:L/SA:H). Becuase this is an EV charger handing significant power, there is a potential safety impact (S:P). This attack can be automated (AU:Y)."},{"lang":"es","value":"Vulnerabilidad de neutralización incorrecta de elementos especiales utilizados en un comando ('Inyección de comando') permite la inyección de comandos del sistema operativo como superusuario este problema afecta al firmware de Iocharger para cargadores modelo AC anteriores a la versión 24120701. Probabilidad: moderada: el atacante primero deberá encontrar el nombre del script y necesita una cuenta (con poco nivel de privilegios) para obtener acceso al script o convencer a un usuario con dicho acceso para que ejecute una solicitud. Impacto: crítico: el atacante tiene control total sobre la estación de carga como usuario superusuario y puede agregar, modificar y eliminar archivos y servicios de forma arbitraria. Aclaración de CVSS: cualquier interfaz de red que sirva a la interfaz de usuario web es vulnerable (AV:N) y no hay medidas de seguridad adicionales para eludir (AC:L), ni el ataque requiere condiciones previas existentes (AT:N). El ataque está autenticado, pero el nivel de autenticación no importa (PR:L), ni se requiere ninguna interacción del usuario (UI:N). El ataque provoca una vulnerabilidad total (VC:H/VI:H/VA:H), y los dispositivos afectados pueden utilizarse para acceder a redes que potencialmente no deberían ser accesibles (SC:L/SI:L/SA:H). Como se trata de un cargador de vehículos eléctricos que gestiona una cantidad importante de energía, existe un posible impacto en la seguridad (S:P). Este ataque puede automatizarse (AU:Y)."}],"affected":[{"source":"csirt@divd.nl","affectedData":[{"vendor":"Iocharger","product":"Iocharger firmware for AC models","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"24120701","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"csirt@divd.nl","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:P/AU:Y/R:X/V:X/RE:X/U:X","baseScore":9.3,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"LOW","subIntegrityImpact":"LOW","subAvailabilityImpact":"HIGH","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"PRESENT","Automatable":"YES","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2025-01-09T15:11:43.639526Z","id":"CVE-2024-43655","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"csirt@divd.nl","type":"Secondary","description":[{"lang":"en","value":"CWE-78"},{"lang":"en","value":"CWE-250"}]}],"references":[{"url":"https://csirt.divd.nl/CVE-2024-43655/","source":"csirt@divd.nl"},{"url":"https://csirt.divd.nl/DIVD-2024-00035/","source":"csirt@divd.nl"},{"url":"https://iocharger.com","source":"csirt@divd.nl"}]}},{"cve":{"id":"CVE-2024-43656","sourceIdentifier":"csirt@divd.nl","published":"2025-01-09T08:15:28.487","lastModified":"2026-06-17T07:51:30.457","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability allows OS Command Injection as root\n\nThis issue affects Iocharger firmware for AC model chargers before version 24120701.\n\nLikelihood: Moderate – It might be difficult for an attacker to identify the file structure of the directory, and then modify the backup to add a new CGI script in the correct directory. Furthermore, the attacker will need an account to restore the settings backup, or convince a user with such access to upload a modified backup file.\n\nImpact: Critical – The attacker has full control over the charging station as the root user, and can arbitrarily add, modify and deletefiles and services.\n\nCVSS clarification: Any network interface serving the web ui is vulnerable (AV:N) and there are not additional security measures to circumvent (AC:L), nor does the attack require and existing preconditions (AT:N). The attack is authenticated, but the level of authentication does not matter (PR:L), nor is any user interaction required (UI:N). The attack leads to a full compromised (VC:H/VI:H/VA:H), and compromised devices can be used to pivot into networks that should potentially not be accessible (SC:L/SI:L/SA:H). Becuase this is an EV charger handing significant power, there is a potential safety impact (S:P). This attack can be automated (AU:Y)."},{"lang":"es","value":"Vulnerabilidad de neutralización incorrecta de elementos especiales utilizados en un comando ('Inyección de comando') permite la inyección de comandos del sistema operativo como superusuario este problema afecta al firmware de Iocharger para cargadores modelo AC anteriores a la versión 24120701. Probabilidad: moderada: puede resultar difícil para un atacante identificar la estructura de archivos del directorio y luego modificar la copia de seguridad para agregar un nuevo script CGI en el directorio correcto. Además, el atacante necesitará una cuenta para restaurar la copia de seguridad de la configuración o convencer a un usuario con dicho acceso para que cargue un archivo de copia de seguridad modificado. Impacto: crítico: el atacante tiene control total sobre la estación de carga como usuario superusuario y puede agregar, modificar y eliminar archivos y servicios de forma arbitraria. Aclaración de CVSS: cualquier interfaz de red que sirva a la interfaz de usuario web es vulnerable (AV:N) y no hay medidas de seguridad adicionales para eludir (AC:L), ni el ataque requiere condiciones previas existentes (AT:N). El ataque está autenticado, pero el nivel de autenticación no importa (PR:L), ni se requiere ninguna interacción del usuario (UI:N). El ataque provoca una vulnerabilidad total (VC:H/VI:H/VA:H), y los dispositivos afectados pueden utilizarse para acceder a redes que potencialmente no deberían ser accesibles (SC:L/SI:L/SA:H). Como se trata de un cargador de vehículos eléctricos que gestiona una cantidad importante de energía, existe un posible impacto en la seguridad (S:P). Este ataque puede automatizarse (AU:Y)."}],"affected":[{"source":"csirt@divd.nl","affectedData":[{"vendor":"Iocharger","product":"Iocharger firmware for AC models","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"24120701","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"csirt@divd.nl","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:P/AU:Y/R:X/V:X/RE:X/U:X","baseScore":9.3,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"LOW","subIntegrityImpact":"LOW","subAvailabilityImpact":"HIGH","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"PRESENT","Automatable":"YES","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2025-01-09T14:49:55.938365Z","id":"CVE-2024-43656","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"csirt@divd.nl","type":"Secondary","description":[{"lang":"en","value":"CWE-78"},{"lang":"en","value":"CWE-434"}]}],"references":[{"url":"https://csirt.divd.nl/CVE-2024-43656/","source":"csirt@divd.nl"},{"url":"https://csirt.divd.nl/DIVD-2024-00035/","source":"csirt@divd.nl"},{"url":"https://iocharger.com","source":"csirt@divd.nl"}]}},{"cve":{"id":"CVE-2024-43657","sourceIdentifier":"csirt@divd.nl","published":"2025-01-09T08:15:28.680","lastModified":"2026-06-17T07:51:30.627","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability allows OS Command Injection as root\n\nThis issue affects Iocharger firmware for AC model chargers before version 24120701.\n\nLikelihood: High. However, the attacker will need a (low privilege) account to gain access to the action.exe CGI binary and upload the crafted firmware file, or convince a user with such access to upload it.\n\nImpact: Critical – The attacker has full control over the charging station as the root user, and can arbitrarily add, modify and deletefiles and services.\n\nCVSS clarification: Any network interface serving the web ui is vulnerable (AV:N) and there are not additional security measures to circumvent (AC:L), nor does the attack require and existing preconditions (AT:N). The attack is authenticated, but the level of authentication does not matter (PR:L), nor is any user interaction required (UI:N). The attack leads to a full compromised (VC:H/VI:H/VA:H), and compromised devices can be used to pivot into networks that should potentially not be accessible (SC:L/SI:L/SA:H). Becuase this is an EV charger handing significant power, there is a potential safety impact (S:P). This attack can be automated (AU:Y)."},{"lang":"es","value":"Vulnerabilidad de neutralización incorrecta de elementos especiales utilizados en un comando ('Inyección de comando') permite la inyección de comandos del sistema operativo como superusuario Este problema afecta al firmware de Iocharger para cargadores modelo AC anteriores a la versión 24120701. Probabilidad: Alta. Sin embargo, el atacante necesitará una cuenta (con poco nivel de privilegios) para obtener acceso al binario CGI action.exe y cargar el archivo de firmware manipulado, o convencer a un usuario con dicho acceso para que lo cargue. Impacto: Crítico: el atacante tiene control total sobre la estación de carga como usuario superusuario y puede agregar, modificar y eliminar archivos y servicios de forma arbitraria. Aclaración de CVSS: cualquier interfaz de red que sirva a la interfaz de usuario web es vulnerable (AV:N) y no hay medidas de seguridad adicionales para eludir (AC:L), ni el ataque requiere condiciones previas existentes (AT:N). El ataque está autenticado, pero el nivel de autenticación no importa (PR:L), ni se requiere ninguna interacción del usuario (UI:N). El ataque provoca una vulnerabilidad total (VC:H/VI:H/VA:H), y los dispositivos afectados pueden utilizarse para acceder a redes que potencialmente no deberían ser accesibles (SC:L/SI:L/SA:H). Como se trata de un cargador de vehículos eléctricos que gestiona una cantidad importante de energía, existe un posible impacto en la seguridad (S:P). Este ataque puede automatizarse (AU:Y)."}],"affected":[{"source":"csirt@divd.nl","affectedData":[{"vendor":"Iocharger","product":"Iocharger firmware for AC models","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"2024120701","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"csirt@divd.nl","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:P/AU:Y/R:X/V:X/RE:X/U:X","baseScore":9.3,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"LOW","subIntegrityImpact":"LOW","subAvailabilityImpact":"HIGH","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"PRESENT","Automatable":"YES","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2025-01-09T14:43:42.626573Z","id":"CVE-2024-43657","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"csirt@divd.nl","type":"Secondary","description":[{"lang":"en","value":"CWE-78"},{"lang":"en","value":"CWE-434"}]}],"references":[{"url":"https://csirt.divd.nl/CVE-2024-43657/","source":"csirt@divd.nl"},{"url":"https://csirt.divd.nl/DIVD-2024-00035/","source":"csirt@divd.nl"},{"url":"https://iocharger.com","source":"csirt@divd.nl"}]}},{"cve":{"id":"CVE-2024-43659","sourceIdentifier":"csirt@divd.nl","published":"2025-01-09T08:15:29.060","lastModified":"2026-06-17T07:51:30.917","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"After gaining access to the firmware of a charging station, a file at can be accessed to obtain default credentials that are the same across all Iocharger AC model EV chargers.\n\nThis issue affects Iocharger firmware for AC models before firmware version 25010801. \n\nThe issue is addressed by requiring a mandatory password change on first login, it is still recommended to change the password on older models.\n\nLikelihood: Moderate – The attacker will first have to abuse a code execution or file inclusion vulnerability (for example by using .sh) to gain access to the .json file, or obtain a firmware dump of the charging station or obtain the firmware via other channels.\n\nImpact: Critical – All chargers using Iocharger firmware for AC models started with the same initial password. For models with firmware version before 25010801 a password change was not mandatory. It is therefore very likely that this firmware password is still active on many chargers. These credentials could, once obtained, allow an attacker to log into many Iocharger charging station, and allow them to execute arbitrary commands via the System → Custom page.\n\nCVSS clarification: Any network interface serving the web ui is vulnerable (AV:N) and there are not additional security measures to circumvent (AC:L), nor does the attack require and existing preconditions (AT:N). The attack is authenticated, and requires high privileges (PR:H), there is no user interaction required (UI:N). The attack leads to a compromised of the confidentialy of the \"super user\" credentials of the device (VC:H/VI:N/VA:N), and can subsequently be used to full compromise and other devices (SC:H/SI:H/SA:H). Becuase this is an EV charger handing significant power, there is a potential safety impact (S:P). This attack can be automated (AU:Y)."},{"lang":"es","value":"Después de obtener acceso al firmware de una estación de carga, se puede acceder a un archivo en para obtener credenciales predeterminadas que son las mismas en todos los cargadores EV del modelo AC de Iocharger. Este problema afecta al firmware de Iocharger para los modelos AC anteriores a la versión de firmware 25010801. El problema se soluciona al requerir un cambio de contraseña obligatorio en el primer inicio de sesión, aún se recomienda cambiar la contraseña en los modelos más antiguos. Probabilidad: moderada: el atacante primero tendrá que aprovechar una vulnerabilidad de ejecución de código o inclusión de archivo (por ejemplo, utilizando .sh) para obtener acceso al archivo .json u obtener un volcado de firmware de la estación de carga u obtener el firmware a través de otros canales. Impacto: crítico: todos los cargadores que usan el firmware de Iocharger para los modelos AC comenzaron con la misma contraseña inicial. Para los modelos con la versión de firmware anterior a 25010801, no era obligatorio un cambio de contraseña. Por lo tanto, es muy probable que esta contraseña de firmware aún esté activa en muchos cargadores. Estas credenciales podrían, una vez obtenidas, permitir a un atacante iniciar sesión en muchas estaciones de carga de Iocharger y permitirles ejecutar comandos arbitrarios a través de la página Sistema ? Personalizado. Aclaración de CVSS: Cualquier interfaz de red que sirva a la interfaz de usuario web es vulnerable (AV:N) y no hay medidas de seguridad adicionales para eludirla (AC:L), ni el ataque requiere condiciones previas existentes (AT:N). El ataque está autenticado y requiere privilegios altos (PR:H), no se requiere interacción del usuario (UI:N). El ataque lleva a comprometer la confidencialidad de las credenciales de \"superusuario\" del dispositivo (VC:H/VI:N/VA:N), y posteriormente puede usarse para comprometer por completo otros dispositivos (SC:H/SI:H/SA:H). Debido a que se trata de un cargador de vehículos eléctricos que gestiona una energía significativa, existe un posible impacto en la seguridad (S:P). Este ataque puede automatizarse (AU:Y)."}],"affected":[{"source":"csirt@divd.nl","affectedData":[{"vendor":"Iocharger","product":"Iocharger firmware for AC models","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"25010801","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"csirt@divd.nl","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:P/AU:N/R:X/V:X/RE:X/U:X","baseScore":8.3,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"HIGH","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"HIGH","subIntegrityImpact":"HIGH","subAvailabilityImpact":"HIGH","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"PRESENT","Automatable":"NO","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","baseScore":7.2,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.2,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2025-01-09T14:48:10.199874Z","id":"CVE-2024-43659","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"csirt@divd.nl","type":"Secondary","description":[{"lang":"en","value":"CWE-256"},{"lang":"en","value":"CWE-1391"},{"lang":"en","value":"CWE-1393"}]}],"references":[{"url":"https://csirt.divd.nl/CVE-2024-43659/","source":"csirt@divd.nl"},{"url":"https://csirt.divd.nl/DIVD-2024-00035/","source":"csirt@divd.nl"},{"url":"https://iocharger.com","source":"csirt@divd.nl"}]}},{"cve":{"id":"CVE-2024-43660","sourceIdentifier":"csirt@divd.nl","published":"2025-01-09T08:15:29.267","lastModified":"2026-06-17T07:51:31.063","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The CGI script .sh can be used to download any file on the filesystem.\n\nThis issue affects Iocharger firmware for AC model chargers beforeversion 24120701.\n\nLikelihood: High, but credentials required.\n\nImpact: Critical – The script can be used to download any file on the filesystem, including sensitive files such as /etc/shadow, the CGI script source code or binaries and configuration files.\n\nCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/S:P/AU:Y\nCVSS clarification. The attack can be executed over any network connection the station is listening to and serves the web interface (AV:N), and there are no additional security measure sin place that need to be circumvented (AC:L), the attack does not rely on preconditions (AT:N). The attack does require authentication, but the level of authentication is irrelevant (PR:L), it does not require user interaction (UI:N). The confidentiality of all files of the devicd can be compromised (VC:H/VI:N/VA:N). There is no impact on subsequent systems. (SC:N/SI:N/SA:N). While this device is an EV charger handing significant amounts of power, this attack in isolation does not have a safety impact. The attack can be automated (AU:Y)."},{"lang":"es","value":"El script CGI .sh se puede utilizar para descargar cualquier archivo en el sistema de archivos. Este problema afecta a Iocharger firmware para AC model chargers anteriores a la versión 24120701. Probabilidad: Alta, pero se requieren credenciales. Impacto: Crítico: el script se puede utilizar para descargar cualquier archivo en el sistema de archivos, incluidos archivos confidenciales como /etc/shadow, el código fuente del script CGI o los archivos binarios y de configuración. CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/S:P/AU:Y Aclaración de CVSS. El ataque se puede ejecutar a través de cualquier conexión de red que la estación esté escuchando y sirva a la interfaz web (AV:N), y no hay ninguna medida de seguridad adicional en el lugar que deba eludirse (AC:L), el ataque no depende de condiciones previas (AT:N). El ataque requiere autenticación, pero el nivel de autenticación es irrelevante (PR:L), no requiere interacción del usuario (UI:N). La confidencialidad de todos los archivos del dispositivo puede verse comprometida (VC:H/VI:N/VA:N). No hay impacto en los sistemas posteriores (SC:N/SI:N/SA:N). Si bien este dispositivo es un cargador de vehículos eléctricos que gestiona cantidades significativas de energía, este ataque en forma aislada no tiene un impacto en la seguridad. El ataque puede automatizarse (AU:Y)."}],"affected":[{"source":"csirt@divd.nl","affectedData":[{"vendor":"Iocharger","product":"Iocharger firmware for AC models","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"24120701","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"csirt@divd.nl","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:X/V:X/RE:X/U:X","baseScore":7.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"YES","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2025-01-09T14:37:36.870610Z","id":"CVE-2024-43660","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"csirt@divd.nl","type":"Secondary","description":[{"lang":"en","value":"CWE-552"}]}],"references":[{"url":"https://csirt.divd.nl/CVE-2024-43660/","source":"csirt@divd.nl"},{"url":"https://csirt.divd.nl/DIVD-2024-00035/","source":"csirt@divd.nl"},{"url":"https://iocharger.com","source":"csirt@divd.nl"}]}},{"cve":{"id":"CVE-2024-43661","sourceIdentifier":"csirt@divd.nl","published":"2025-01-09T08:15:29.450","lastModified":"2026-06-17T07:51:31.223","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The .so library, which is used by , is\nvulnerable to a buffer overflow in the code that handles the deletion\nof certificates. This buffer overflow can be triggered by providing a\nlong file path to the action of the .exe CGI binary or\nto the .sh CGI script. This binary or script will write this\nfile path to , which is then\nread by .so\n\n\nThis issue affects Iocharger firmware for AC models before version 24120701.\n\nLikelihood: Moderate – An attacker will have to find this exploit by\neither obtaining the binaries involved in this vulnerability, or by trial\nand error. Furthermore, the attacker will need a (low privilege)\naccount to gain access to the .exe CGI binary or .sh\nscript to trigger the vulnerability, or convince a user with such access\nsend an HTTP request that triggers it.\n\n\nImpact: High – The process, which we assume is\nresponsible for OCPP communication, will keep crashing after\nperforming the exploit. This happens because the buffer overflow\ncauses the process to segfault before\n is removed. This means that,\neven though is automatically restarted, it will crash\nagain as soon as it tries to parse the text file.\n\nCVSS clarification. The attack can be executed over any network connection the station is listening to and serves the web interface (AV:N), and there are no additional security measure sin place that need to be circumvented (AC:L), the attack does not rely on preconditions (AT:N). The attack does require authentication, but the level of authentication is irrelevant (PR:L), it does not require user interaction (UI:N). The attack leads to reducred availability of the device (VC:N/VI:N/VA:H). THere is not impact on subsequent systems. (SC:N/SI:N/SA:N). Alltough this device is an EV charger handing significant amounts of power, we do not forsee a safety impact. The attack can be automated (AU:Y). Because the DoS condition is written to disk persistantly, it cannot be recovered by the user (R:I)."},{"lang":"es","value":"La librería .so, que es utilizada por , es vulnerable a un desbordamiento de búfer en el código que gestiona la eliminación de certificados. Este desbordamiento de búfer se puede activar al proporcionar una ruta de archivo larga a la acción del binario CGI .exe o al script CGI .sh. Este binario o script escribirá esta ruta de archivo en , que luego es leído por .so. Este problema afecta al firmware de Iocharger para modelos AC anteriores a la versión 24120701. Probabilidad: Moderada: un atacante tendrá que encontrar esta vulnerabilidad obteniendo los binarios involucrados en esta vulnerabilidad o por ensayo y error. Además, el atacante necesitará una cuenta (con poco nivel de privilegios) para obtener acceso al binario CGI .exe o al script .sh para activar la vulnerabilidad, o convencer a un usuario con dicho acceso de que envíe una solicitud HTTP que la active. Impacto: alto: el proceso , que suponemos que es responsable de la comunicación OCPP, seguirá fallando después de ejecutar el exploit. Esto sucede porque el desbordamiento del búfer hace que el proceso se segmente antes de que se elimine . Esto significa que, aunque se reinicie automáticamente, se bloqueará nuevamente tan pronto como intente analizar el archivo de texto. Aclaración de CVSS. El ataque se puede ejecutar en cualquier conexión de red que la estación esté escuchando y sirva a la interfaz web (AV:N), y no hay ninguna medida de seguridad adicional en el lugar que deba eludirse (AC:L), el ataque no depende de condiciones previas (AT:N). El ataque requiere autenticación, pero el nivel de autenticación es irrelevante (PR:L), no requiere interacción del usuario (UI:N). El ataque conduce a una disponibilidad reducida del dispositivo (VC:N/VI:N/VA:H). No hay impacto en los sistemas posteriores. (SC:N/SI:N/SA:N). Aunque este dispositivo es un cargador de vehículos eléctricos que gestiona cantidades significativas de energía, no prevemos un impacto en la seguridad. El ataque puede automatizarse (AU:Y). Debido a que la condición de denegación de servicio se escribe en el disco de forma persistente, el usuario no puede recuperarla (R:I)."}],"affected":[{"source":"csirt@divd.nl","affectedData":[{"vendor":"Iocharger","product":"Iocharger firmware for AC models","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"24120701","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"csirt@divd.nl","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:I/V:X/RE:X/U:X","baseScore":7.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"YES","Recovery":"IRRECOVERABLE","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":9.8,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2025-01-09T14:40:55.906992Z","id":"CVE-2024-43661","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"csirt@divd.nl","type":"Secondary","description":[{"lang":"en","value":"CWE-121"}]}],"references":[{"url":"https://csirt.divd.nl/CVE-2024-43661/","source":"csirt@divd.nl"},{"url":"https://csirt.divd.nl/DIVD-2024-00035/","source":"csirt@divd.nl"},{"url":"https://iocharger.com","source":"csirt@divd.nl"}]}},{"cve":{"id":"CVE-2024-43662","sourceIdentifier":"csirt@divd.nl","published":"2025-01-09T08:15:29.637","lastModified":"2026-06-17T07:51:31.400","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The .exe or .exe CGI binary can be used to upload arbitrary files to /tmp/upload/ or /tmp/ respectively as any user, although the user interface for uploading files is only shown to the iocadmin user.\n\nThis issue affects Iocharger firmware for AC models before version 24120701.\n\nLikelihood: Moderate – An attacker will need to have knowledge of this CGI binary, e.g. by finding it in firmware. Furthermore, the attacker will need a (low privilege) account to gain access to the .exe or .exe CGI binary and upload the file, or convince a user with such access to upload it.\n\nImpact: Low – The attacker can upload arbitrary files to /tmp/upload/ or /tmp/. However, the attacker is unable to access or use these files without other vulnerabilities.\n\nCVSS clarification. The attack can be executed over any network connection the station is listening to and serves the web interface (AV:N), and there are no additional security measure sin place that need to be circumvented (AC:L), the attack does not rely on preconditions (AT:N). The attack does require authentication, but the level of authentication is irrelevant (PR:L), it does not require user interaction (UI:N). Artitrary files can be uploaded, be these files will not be in a location where they can influence confidentiality or availability and have a minimal impact on device integrity (VC:N/VI:L/VA:N). There is no impact on subsequent systems. (SC:N/SI:N/SA:N). While this device is an EV charger handing significant amounts of power, we do not expect this vulnerability to have a safety impact. The attack can be automated (AU:Y)."},{"lang":"es","value":"El binario CGI .exe o .exe se puede utilizar para cargar archivos arbitrarios en /tmp/upload/ o /tmp/ respectivamente como cualquier usuario, aunque la interfaz de usuario para cargar archivos solo se muestra al usuario iocadmin. Este problema afecta al firmware de Iocharger para modelos AC anteriores a la versión 24120701. Probabilidad: moderada: un atacante deberá tener conocimiento de este binario CGI, por ejemplo, buscándolo en el firmware. Además, el atacante necesitará una cuenta (con privilegios bajos) para obtener acceso al binario CGI .exe o .exe y cargar el archivo, o convencer a un usuario con dicho acceso para que lo cargue. Impacto: bajo: el atacante puede cargar archivos arbitrarios en /tmp/upload/ o /tmp/. Sin embargo, el atacante no puede acceder ni usar estos archivos sin otras vulnerabilidades. Aclaración de CVSS. El ataque se puede ejecutar en cualquier conexión de red que la estación esté escuchando y que sirva a la interfaz web (AV:N), y no hay ninguna medida de seguridad adicional que se deba eludir (AC:L), el ataque no depende de condiciones previas (AT:N). El ataque requiere autenticación, pero el nivel de autenticación es irrelevante (PR:L), no requiere interacción del usuario (UI:N). Se pueden cargar archivos adjuntos, pero estos archivos no estarán en una ubicación donde puedan influir en la confidencialidad o disponibilidad y tendrán un impacto mínimo en la integridad del dispositivo (VC:N/VI:L/VA:N). No hay impacto en los sistemas posteriores. (SC:N/SI:N/SA:N). Si bien este dispositivo es un cargador de vehículos eléctricos que gestiona cantidades significativas de energía, no esperamos que esta vulnerabilidad tenga un impacto en la seguridad. El ataque se puede automatizar (AU:Y)."}],"affected":[{"source":"csirt@divd.nl","affectedData":[{"vendor":"Iocharger","product":"Iocharger firmware for AC models","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"24120701","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"csirt@divd.nl","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:X/V:X/RE:X/U:X","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"YES","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2025-01-09T15:07:52.620397Z","id":"CVE-2024-43662","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"csirt@divd.nl","type":"Secondary","description":[{"lang":"en","value":"CWE-434"},{"lang":"en","value":"CWE-862"}]}],"references":[{"url":"https://csirt.divd.nl/CVE-2024-43662/","source":"csirt@divd.nl"},{"url":"https://csirt.divd.nl/DIVD-2024-00035/","source":"csirt@divd.nl"},{"url":"https://iocharger.com","source":"csirt@divd.nl"}]}},{"cve":{"id":"CVE-2024-43663","sourceIdentifier":"csirt@divd.nl","published":"2025-01-09T08:15:29.810","lastModified":"2026-06-17T07:51:31.537","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"There are many buffer overflow vulnerabilities present in several CGI binaries of the charging station.This issue affects Iocharger firmware for AC model chargers beforeversion 24120701.\n\nLikelihood: High – Given the prevalence of these buffer overflows, and the clear error message of the web server, an attacker is very likely to be able to find these vulnerabilities.\n\nImpact: Low – Usually, overflowing one of these buffers just causes a segmentation fault of the CGI binary, which causes the web server to return a 502 Bad Gateway error. However the webserver itself is not affected, and no DoS can be achieved. Abusing these buffer overflows in a meaningful way requires highly technical knowledge, especially since ASLR also seems to be enabled on the charging station. However, a skilled attacker might be able to use one of these buffer overflows to obtain remote code execution.\n\nCVSS clarification. The attack can be executed over any network connection the station is listening to and serves the web interface (AV:N), and there are no additional security measure sin place that need to be circumvented (AC:L), the attack does not rely on preconditions (AT:N). The attack does require authentication, but the level of authentication is irrelevant (PR:L), it does not require user interaction (UI:N). The attack has a small impact on the availability of the device (VC:N/VI:N/VA:L). There is no impact on subsequent systems. (SC:N/SI:N/SA:N). While this device is an EV charger handing significant amounts of power, we do not expect  this vulnerability to have a safety impact. The attack can be automated (AU:Y)."},{"lang":"es","value":"Existen muchas vulnerabilidades de desbordamiento de búfer presentes en varios binarios CGI de la estación de carga. Este problema afecta al firmware de Iocharger para cargadores de modelos de CA anteriores a la versión 24120701. Probabilidad: Alta: dada la prevalencia de estos desbordamientos de búfer y el claro mensaje de error del servidor web, es muy probable que un atacante pueda encontrar estas vulnerabilidades. Impacto: Bajo: por lo general, el desbordamiento de uno de estos búferes solo provoca un error de segmentación del binario CGI, lo que hace que el servidor web devuelva un error 502 Bad Gateway. Sin embargo, el servidor web en sí no se ve afectado y no se puede lograr ningún ataque de denegación de servicio. Abusar de estos desbordamientos de búfer de una manera significativa requiere un alto nivel de conocimientos técnicos, especialmente porque ASLR también parece estar habilitado en la estación de carga. Sin embargo, un atacante experto podría ser capaz de utilizar uno de estos desbordamientos de búfer para obtener la ejecución remota de código. Aclaración de CVSS. El ataque se puede ejecutar a través de cualquier conexión de red que la estación esté escuchando y que sirva a la interfaz web (AV:N), y no existen medidas de seguridad adicionales que se deban eludir (AC:L), el ataque no depende de condiciones previas (AT:N). El ataque requiere autenticación, pero el nivel de autenticación es irrelevante (PR:L), no requiere interacción del usuario (UI:N). El ataque tiene un pequeño impacto en la disponibilidad del dispositivo (VC:N/VI:N/VA:L). No hay impacto en los sistemas posteriores (SC:N/SI:N/SA:N). Si bien este dispositivo es un cargador de vehículos eléctricos que gestiona cantidades significativas de energía, no esperamos que esta vulnerabilidad tenga un impacto en la seguridad. El ataque se puede automatizar (AU:Y)."}],"affected":[{"source":"csirt@divd.nl","affectedData":[{"vendor":"Iocharger","product":"Iocharger firmware for AC models","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"24120701","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"csirt@divd.nl","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:A/V:X/RE:X/U:X","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"YES","Recovery":"AUTOMATIC","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":9.8,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2025-01-09T14:47:03.073105Z","id":"CVE-2024-43663","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"csirt@divd.nl","type":"Secondary","description":[{"lang":"en","value":"CWE-121"}]}],"references":[{"url":"https://csirt.divd.nl/CVE-2024-43663/","source":"csirt@divd.nl"},{"url":"https://csirt.divd.nl/DIVD-2024-00035/","source":"csirt@divd.nl"},{"url":"https://iocharger.com","source":"csirt@divd.nl"}]}},{"cve":{"id":"CVE-2025-21187","sourceIdentifier":"secure@microsoft.com","published":"2025-01-14T18:15:31.187","lastModified":"2026-06-17T08:42:43.740","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Microsoft Power Automate Remote Code Execution Vulnerability"},{"lang":"es","value":"Vulnerabilidad de ejecución remota de código en Microsoft Power Automate"}],"affected":[{"source":"secure@microsoft.com","affectedData":[{"vendor":"Microsoft","product":"Power Automate for Desktop","versions":[{"version":"1.0.0.0","lessThan":"2.52.62.25009","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"secure@microsoft.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2025-01-28T04:55:28.715702Z","id":"CVE-2025-21187","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"secure@microsoft.com","type":"Secondary","description":[{"lang":"en","value":"CWE-94"}]},{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"NVD-CWE-noinfo"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:microsoft:power_automate_for_desktop:*:*:*:*:*:*:*:*","versionStartIncluding":"2.46","versionEndExcluding":"2.46.184.25013","matchCriteriaId":"A3AE490E-B66C-45D1-81FE-46C8DB0D9A7A"},{"vulnerable":true,"criteria":"cpe:2.3:a:microsoft:power_automate_for_desktop:*:*:*:*:*:*:*:*","versionStartIncluding":"2.47","versionEndExcluding":"2.47.126.25010","matchCriteriaId":"78453D1B-A64E-4596-9208-462526C0627C"},{"vulnerable":true,"criteria":"cpe:2.3:a:microsoft:power_automate_for_desktop:*:*:*:*:*:*:*:*","versionStartIncluding":"2.48","versionEndExcluding":"2.48.164.25010","matchCriteriaId":"1BAD3381-BDB2-42FC-89E7-96A388288F09"},{"vulnerable":true,"criteria":"cpe:2.3:a:microsoft:power_automate_for_desktop:*:*:*:*:*:*:*:*","versionStartIncluding":"2.49","versionEndExcluding":"2.49.182.25010","matchCriteriaId":"91E8C064-A7DB-4C2D-8594-28A6C1012A88"},{"vulnerable":true,"criteria":"cpe:2.3:a:microsoft:power_automate_for_desktop:*:*:*:*:*:*:*:*","versionStartIncluding":"2.50","versionEndExcluding":"2.50.139.25010","matchCriteriaId":"23AE7E1D-6A5D-4750-BB9A-2D626CC0CE1F"},{"vulnerable":true,"criteria":"cpe:2.3:a:microsoft:power_automate_for_desktop:*:*:*:*:*:*:*:*","versionStartIncluding":"2.51","versionEndExcluding":"2.51.349.24355","matchCriteriaId":"C03A1069-DBBE-4C3A-A315-C80870819A80"}]}]}],"references":[{"url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-21187","source":"secure@microsoft.com","tags":["Vendor Advisory"]}]}},{"cve":{"id":"CVE-2025-29817","sourceIdentifier":"secure@microsoft.com","published":"2025-04-15T17:15:48.873","lastModified":"2026-06-17T09:05:43.307","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Uncontrolled search path element in Power Automate allows an authorized attacker to disclose information over a network."},{"lang":"es","value":"El elemento de ruta de búsqueda no controlada en Power Automate permite que un atacante autorizado divulgue información a través de una red."}],"affected":[{"source":"secure@microsoft.com","affectedData":[{"vendor":"Microsoft","product":"Power Automate for Desktop","versions":[{"version":"1.0.0.0","lessThan":"2.51.349.24355","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"secure@microsoft.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N","baseScore":5.7,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.1,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2025-04-15T17:52:51.533548Z","id":"CVE-2025-29817","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"secure@microsoft.com","type":"Secondary","description":[{"lang":"en","value":"CWE-427"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:microsoft:power_automate_for_desktop:*:*:*:*:*:*:*:*","versionEndExcluding":"2.51.349.24355","matchCriteriaId":"521C8D25-648F-4E5D-8AA8-EEF7EDCEF21F"}]}]}],"references":[{"url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-29817","source":"secure@microsoft.com","tags":["Vendor Advisory"]}]}},{"cve":{"id":"CVE-2025-47966","sourceIdentifier":"secure@microsoft.com","published":"2025-06-05T21:15:22.127","lastModified":"2026-06-17T09:28:54.750","vulnStatus":"Analyzed","cveTags":[{"sourceIdentifier":"secure@microsoft.com","tags":["exclusively-hosted-service"]}],"descriptions":[{"lang":"en","value":"Exposure of sensitive information to an unauthorized actor in Power Automate allows an unauthorized attacker to elevate privileges over a network."},{"lang":"es","value":"La exposición de información confidencial a un actor no autorizado en Power Automate permite que un atacante no autorizado eleve privilegios en una red."}],"affected":[{"source":"secure@microsoft.com","affectedData":[{"vendor":"Microsoft","product":"Power Automate for Desktop","versions":[{"version":"-","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"secure@microsoft.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":9.8,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2025-06-07T03:55:21.826802Z","id":"CVE-2025-47966","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"secure@microsoft.com","type":"Secondary","description":[{"lang":"en","value":"CWE-200"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:microsoft:power_automate_for_desktop:-:*:*:*:*:*:*:*","matchCriteriaId":"C1B231AB-37F6-4226-A774-952FCE9AB2AE"}]}]}],"references":[{"url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-47966","source":"secure@microsoft.com","tags":["Broken Link"]}]}},{"cve":{"id":"CVE-2025-0657","sourceIdentifier":"productsecurity@carrier.com","published":"2025-11-27T01:15:46.437","lastModified":"2026-06-17T08:26:54.750","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"A weakness in Automated Logic and Carrier i-Vu Gen5 router on driver\n version drv_gen5_106-01-2380, allows\n malformed packets to be sent through BACnet MS/TP network causing the devices to enter a fault state. This fault state requires a manual power cycle to\n return the device to network visibility."}],"affected":[{"source":"productsecurity@carrier.com","affectedData":[{"vendor":"Automated Logic","product":"WebCtrl","defaultStatus":"unaffected","platforms":["Windows"],"versions":[{"version":"0","lessThanOrEqual":"8.5","versionType":"custom","status":"affected"}]},{"vendor":"Automated Logic","product":"Gen5 Controllers","defaultStatus":"unaffected","versions":[{"version":"0","lessThanOrEqual":"drv_gen5_108-04-20120","versionType":"custom","status":"affected"}]},{"vendor":"Carrier","product":"i-Vu","defaultStatus":"unaffected","platforms":["Windows"],"versions":[{"version":"0","lessThanOrEqual":"8.5","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"productsecurity@carrier.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2025-11-28T14:41:24.308783Z","id":"CVE-2025-0657","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"productsecurity@carrier.com","type":"Secondary","description":[{"lang":"en","value":"CWE-129"},{"lang":"en","value":"CWE-248"}]}],"references":[{"url":"https://www.corporate.carrier.com/product-security/advisories-resources/","source":"productsecurity@carrier.com"}]}},{"cve":{"id":"CVE-2025-0658","sourceIdentifier":"productsecurity@carrier.com","published":"2025-11-27T01:15:46.583","lastModified":"2026-06-17T08:26:54.857","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"A vulnerability in Automated Logic and Carrier's Zone Controller via BACnet protocol\ncauses the device to crash. The device enters a fault state; after a reset,\na second packet can leave it permanently unresponsive until a manual power cycle\nis performed."}],"affected":[{"source":"productsecurity@carrier.com","affectedData":[{"vendor":"Automated Logic","product":"Zone Controllers","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"6.06-101","versionType":"custom","status":"affected"}]},{"vendor":"Carrier","product":"Zone Controllers","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"6.06-101","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"productsecurity@carrier.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":8.7,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2025-11-28T14:41:25.816751Z","id":"CVE-2025-0658","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"productsecurity@carrier.com","type":"Secondary","description":[{"lang":"en","value":"CWE-20"}]}],"references":[{"url":"https://https://www.corporate.carrier.com/product-security/advisories-resources/","source":"productsecurity@carrier.com"}]}},{"cve":{"id":"CVE-2026-33941","sourceIdentifier":"security-advisories@github.com","published":"2026-03-27T22:16:21.203","lastModified":"2026-09-04T13:19:26.700","vulnStatus":"Modified","cveTags":[],"descriptions":[{"lang":"en","value":"Handlebars provides the power necessary to let users build semantic templates. In versions 4.0.0 through 4.7.8, the Handlebars CLI precompiler (`bin/handlebars` / `lib/precompiler.js`) concatenates user-controlled strings — template file names and several CLI options — directly into the JavaScript it emits, without any escaping or sanitization. An attacker who can influence template filenames or CLI arguments can inject arbitrary JavaScript that executes when the generated bundle is loaded in Node.js or a browser. Version 4.7.9 fixes the issue. Some workarounds are available. First, validate all CLI inputs before invoking the precompiler. Reject filenames and option values that contain characters with JavaScript string-escaping significance (`\"`, `'`, `;`, etc.). Second, use a fixed, trusted namespace string passed via a configuration file rather than command-line arguments in automated pipelines. Third, run the precompiler in a sandboxed environment (container with no write access to sensitive paths) to limit the impact of successful exploitation. Fourth, audit template filenames in any repository or package that is consumed by an automated build pipeline."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"handlebars-lang","product":"handlebars.js","versions":[{"version":">= 4.0.0, < 4.7.9","status":"affected"}]}]},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","affectedData":[{"vendor":"Red Hat","product":"Cluster Observability Operator 1.5.0","defaultStatus":"affected","collectionURL":"https://catalog.redhat.com/software/containers/","packageName":"cluster-observability-operator/logging-console-plugin-pf4-rhel9","cpes":["cpe:/a:redhat:cluster_observability_operator:1.5::el9"],"versions":[{"version":"1782839279","lessThan":"*","versionType":"rpm","status":"unaffected"}]},{"vendor":"Red Hat","product":"Cluster Observability Operator 1.5.0","defaultStatus":"affected","collectionURL":"https://catalog.redhat.com/software/containers/","packageName":"cluster-observability-operator/logging-console-plugin-pf5-rhel9","cpes":["cpe:/a:redhat:cluster_observability_operator:1.5::el9"],"versions":[{"version":"1782840539","lessThan":"*","versionType":"rpm","status":"unaffected"}]},{"vendor":"Red Hat","product":"Cluster Observability Operator 1.5.0","defaultStatus":"affected","collectionURL":"https://catalog.redhat.com/software/containers/","packageName":"cluster-observability-operator/troubleshooting-panel-console-plugin-pf6-rhel9","cpes":["cpe:/a:redhat:cluster_observability_operator:1.5::el9"],"versions":[{"version":"1782839996","lessThan":"*","versionType":"rpm","status":"unaffected"}]},{"vendor":"Red Hat","product":"Red Hat OpenShift Dev Spaces 3.27","defaultStatus":"affected","collectionURL":"https://catalog.redhat.com/software/containers/","packageName":"devspaces/code-rhel9","cpes":["cpe:/a:redhat:openshift_devspaces:3.27::el9"],"versions":[{"version":"1776744110","lessThan":"*","versionType":"rpm","status":"unaffected"}]},{"vendor":"Red Hat","product":"Cryostat 4","defaultStatus":"unaffected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"handlebars","cpes":["cpe:/a:redhat:cryostat:4"]},{"vendor":"Red Hat","product":"Logging Subsystem for Red Hat OpenShift","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"openshift-logging/elasticsearch6-rhel9","cpes":["cpe:/a:redhat:logging:5"]},{"vendor":"Red Hat","product":"Logging Subsystem for Red Hat OpenShift","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"openshift-logging/elasticsearch-operator-bundle","cpes":["cpe:/a:redhat:logging:5"]},{"vendor":"Red Hat","product":"Logging Subsystem for Red Hat OpenShift","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"openshift-logging/elasticsearch-proxy-rhel9","cpes":["cpe:/a:redhat:logging:5"]},{"vendor":"Red Hat","product":"Logging Subsystem for Red Hat OpenShift","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"openshift-logging/elasticsearch-rhel9-operator","cpes":["cpe:/a:redhat:logging:5"]},{"vendor":"Red Hat","product":"Logging Subsystem for Red Hat OpenShift","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"openshift-logging/kibana6-rhel8","cpes":["cpe:/a:redhat:logging:5"]},{"vendor":"Red Hat","product":"Logging Subsystem for Red Hat OpenShift","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"openshift-logging/logging-curator5-rhel9","cpes":["cpe:/a:redhat:logging:5"]},{"vendor":"Red Hat","product":"Red Hat Data Grid 8","defaultStatus":"unaffected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"handlebars","cpes":["cpe:/a:redhat:jboss_data_grid:8"]},{"vendor":"Red Hat","product":"Red Hat Developer Hub","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"rhdh/rhdh-hub-rhel9","cpes":["cpe:/a:redhat:rhdh:1"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 10","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"firefox","cpes":["cpe:/o:redhat:enterprise_linux:10"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 10","defaultStatus":"unaffected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"thunderbird","cpes":["cpe:/o:redhat:enterprise_linux:10"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 7","defaultStatus":"unaffected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"firefox","cpes":["cpe:/o:redhat:enterprise_linux:7"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 8","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"389-ds:1.4/389-ds-base","cpes":["cpe:/o:redhat:enterprise_linux:8"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 8","defaultStatus":"unaffected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"firefox","cpes":["cpe:/o:redhat:enterprise_linux:8"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 8","defaultStatus":"unaffected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"grafana","cpes":["cpe:/o:redhat:enterprise_linux:8"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 8","defaultStatus":"unaffected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"mozjs60","cpes":["cpe:/o:redhat:enterprise_linux:8"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 8","defaultStatus":"unaffected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"thunderbird","cpes":["cpe:/o:redhat:enterprise_linux:8"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 9","defaultStatus":"unaffected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"firefox","cpes":["cpe:/o:redhat:enterprise_linux:9"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 9","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"thunderbird","cpes":["cpe:/o:redhat:enterprise_linux:9"]},{"vendor":"Red Hat","product":"Red Hat OpenShift AI (RHOAI)","defaultStatus":"unaffected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"rhoai/odh-workbench-codeserver-datascience-cpu-py312-rhel9","cpes":["cpe:/a:redhat:openshift_ai"]},{"vendor":"Red Hat","product":"Red Hat Process Automation 7","defaultStatus":"unaffected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"handlebars","cpes":["cpe:/a:redhat:jboss_enterprise_bpms_platform:7"]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H","baseScore":8.2,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.5,"impactScore":6.0},{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H","baseScore":8.2,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.5,"impactScore":6.0},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H","baseScore":8.2,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.5,"impactScore":6.0}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-03-31T00:00:00+00:00","id":"CVE-2026-33941","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"},{"lang":"en","value":"CWE-94"},{"lang":"en","value":"CWE-116"}]},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary","description":[{"lang":"en","value":"CWE-94"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:handlebarsjs:handlebars:*:*:*:*:*:node.js:*:*","versionStartIncluding":"4.0.0","versionEndExcluding":"4.7.9","matchCriteriaId":"A9D1F9A7-8359-4C3F-9932-4A085094F388"}]}]}],"references":[{"url":"https://github.com/handlebars-lang/handlebars.js/commit/68d8df5a88e0a26fe9e6084c5c6aaebe67b07da2","source":"security-advisories@github.com","tags":["Patch"]},{"url":"https://github.com/handlebars-lang/handlebars.js/releases/tag/v4.7.9","source":"security-advisories@github.com","tags":["Release Notes"]},{"url":"https://github.com/handlebars-lang/handlebars.js/security/advisories/GHSA-xjpj-3mr7-gcpf","source":"security-advisories@github.com","tags":["Exploit","Vendor Advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:10175","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:34342","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/security/cve/CVE-2026-33941","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2452524","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-33941.json","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}]}},{"cve":{"id":"CVE-2026-40374","sourceIdentifier":"secure@microsoft.com","published":"2026-05-12T18:17:16.347","lastModified":"2026-06-17T10:45:12.543","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Exposure of sensitive information to an unauthorized actor in Power Automate allows an authorized attacker to disclose information over a network."}],"affected":[{"source":"secure@microsoft.com","affectedData":[{"vendor":"Microsoft","product":"Power Automate for Desktop","versions":[{"version":"1.0.0.0","lessThan":"2.67","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"secure@microsoft.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-05-12T19:33:16.189460Z","id":"CVE-2026-40374","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"secure@microsoft.com","type":"Secondary","description":[{"lang":"en","value":"CWE-200"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:microsoft:power_automate_for_desktop:*:*:*:*:*:*:*:*","versionEndExcluding":"2.67","matchCriteriaId":"4238565A-8114-4C12-BF12-3A064E1C5029"}]}]}],"references":[{"url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-40374","source":"secure@microsoft.com","tags":["Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-65818","sourceIdentifier":"secure@microsoft.com","published":"2026-09-03T23:17:19.817","lastModified":"2026-09-08T17:51:16.750","vulnStatus":"Analyzed","cveTags":[{"sourceIdentifier":"secure@microsoft.com","tags":["exclusively-hosted-service"]}],"descriptions":[{"lang":"en","value":"Server-side request forgery (ssrf) in Power Automate allows an authorized attacker to elevate privileges over a network."}],"affected":[{"source":"secure@microsoft.com","affectedData":[{"vendor":"Microsoft","product":"Microsoft Power Platform","versions":[{"version":"-","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"secure@microsoft.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H","baseScore":8.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"LOW","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":6.0},{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","baseScore":9.9,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.1,"impactScore":6.0}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-04T00:00:00+00:00","id":"CVE-2026-65818","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"secure@microsoft.com","type":"Secondary","description":[{"lang":"en","value":"CWE-918"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:microsoft:power_platform:-:*:*:*:*:*:*:*","matchCriteriaId":"DAFE085E-8D29-4B6C-883E-92DC71109AA9"}]}]}],"references":[{"url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-65818","source":"secure@microsoft.com","tags":["Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-77897","sourceIdentifier":"secure@microsoft.com","published":"2026-09-08T18:20:39.850","lastModified":"2026-09-29T19:42:55.140","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Relative path traversal in Power Automate allows an authorized attacker to elevate privileges locally."}],"affected":[{"source":"secure@microsoft.com","affectedData":[{"vendor":"Microsoft","product":"Power Automate agent for virtual desktops","versions":[{"version":"1.0.0.0","lessThan":"2.71.115.26224","versionType":"custom","status":"affected"}]},{"vendor":"Microsoft","product":"Power Automate for Desktop","versions":[{"version":"1.0.0.0","lessThan":"2.71.115.26224","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"secure@microsoft.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.0,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"HIGH","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.0,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-09T16:15:09.806116Z","id":"CVE-2026-77897","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"secure@microsoft.com","type":"Secondary","description":[{"lang":"en","value":"CWE-23"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:microsoft:power_automate_for_desktop:*:*:*:*:*:*:*:*","versionEndExcluding":"2.71.115.26224","matchCriteriaId":"95527D30-39C3-4861-9B0D-0ED2ECF392EE"}]}]}],"references":[{"url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-77897","source":"secure@microsoft.com","tags":["Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-104741","sourceIdentifier":"security@wordfence.com","published":"2026-10-10T06:16:39.087","lastModified":"2026-10-11T17:16:59.930","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"The AI Puffer – Chat. Create. Automate. (formerly AI Power) plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.4.89. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to modify global plugin indexing and vector-search configuration options (aipkit_training_general_settings and aipkit_indexing_field_settings), including chunking parameters, file upload visibility, and per-CPT field indexing settings, affecting all users of the plugin. This is only exploitable in configurations where an administrator has granted 'sources' module access to a lower-privileged role via the plugin's Role Manager."}],"affected":[{"source":"security@wordfence.com","affectedData":[{"vendor":"senols","product":"AI Puffer – AI Chatbot, AI Writer & Automation","defaultStatus":"unaffected","versions":[{"version":"0","lessThanOrEqual":"2.4.89","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security@wordfence.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N","baseScore":3.1,"baseSeverity":"LOW","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":1.6,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-11T16:41:03.547230Z","id":"CVE-2026-104741","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@wordfence.com","type":"Secondary","description":[{"lang":"en","value":"CWE-862"}]}],"references":[{"url":"https://plugins.trac.wordpress.org/browser/gpt3-ai-content-generator/tags/2.4.88/classes/core/ajax/class-aipkit-core-ajax-handler.php#L737","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/gpt3-ai-content-generator/tags/2.4.88/classes/core/ajax/class-aipkit-core-ajax-handler.php#L883","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/gpt3-ai-content-generator/tags/2.4.88/classes/core/ajax/class-aipkit-core-ajax-handler.php#L950","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/gpt3-ai-content-generator/tags/2.4.88/classes/dashboard/ajax/class-aipkit-base-dashboard-ajax-handler.php#L53","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/changeset?reponame=&old=3725365%40gpt3-ai-content-generator&new=3725365%40gpt3-ai-content-generator","source":"security@wordfence.com"},{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/25ae6c7d-a03c-43f6-9c46-8797a9765d04?source=cve","source":"security@wordfence.com"}]}},{"cve":{"id":"CVE-2026-104742","sourceIdentifier":"security@wordfence.com","published":"2026-10-10T06:16:39.240","lastModified":"2026-10-11T17:17:00.083","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"The AI Puffer – Chat. Create. Automate. (formerly AI Power) plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.4.89. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to modify global site-wide semantic search settings, including vector provider, embedding provider, embedding model, target ID, number of results, and no-results text stored in aipkit_options, that are otherwise restricted to administrators. Exploitation requires that an administrator has previously granted the Knowledge Base ('sources') module to the attacker's role via the Role Manager, as this access is not available to lower-privileged users by default."}],"affected":[{"source":"security@wordfence.com","affectedData":[{"vendor":"senols","product":"AI Puffer – AI Chatbot, AI Writer & Automation","defaultStatus":"unaffected","versions":[{"version":"0","lessThanOrEqual":"2.4.89","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security@wordfence.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N","baseScore":3.1,"baseSeverity":"LOW","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":1.6,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-11T16:41:16.167246Z","id":"CVE-2026-104742","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@wordfence.com","type":"Secondary","description":[{"lang":"en","value":"CWE-862"}]}],"references":[{"url":"https://plugins.trac.wordpress.org/browser/gpt3-ai-content-generator/tags/2.4.88/classes/dashboard/ajax/class-aipkit-base-dashboard-ajax-handler.php#L53","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/gpt3-ai-content-generator/tags/2.4.88/classes/dashboard/ajax/class-aipkit-settings-ajax-handler.php#L137","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/gpt3-ai-content-generator/tags/2.4.88/classes/dashboard/ajax/class-aipkit-settings-ajax-handler.php#L790","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/gpt3-ai-content-generator/tags/2.4.88/classes/dashboard/class-aipkit_role_manager.php#L275","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/changeset?reponame=&old=3725365%40gpt3-ai-content-generator&new=3725365%40gpt3-ai-content-generator","source":"security@wordfence.com"},{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/58967ac0-d6f7-4cc7-a2e3-4594aa4b2be2?source=cve","source":"security@wordfence.com"}]}}]}