{"answers":{"affected":"","exploited":"There is no known exploitation of CVE-2024-43649 in the wild and no public exploit code.","fix":"No fix has been published for CVE-2024-43649 yet. Limit exposure of the affected software until one is available.","what":"CVE-2024-43649 is a critical command injection vulnerability in Iocharger firmware for AC models, published on 9 Jan 2025. Any signed-in user can exploit it over the network, with no action from the victim."},"fix_prompt":"Check this codebase for CVE-2024-43649 and fix it if it is affected.\n\nWhat it is: CVE-2024-43649 is a critical command injection vulnerability in Iocharger firmware for AC models, published on 9 Jan 2025. Any signed-in user can exploit it over the network, with no action from the victim.\nExploitation: There is no known exploitation of CVE-2024-43649 in the wild and no public exploit code.\n\nAffected product: Iocharger firmware for AC models. No package-level version data is available, so check the vendor advisory linked from the reference page.\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2024-43649/ (Markdown: https://insights.sbomify.com/CVE-2024-43649/index.md)","id":"CVE-2024-43649","markdown":"https://insights.sbomify.com/CVE-2024-43649/index.md","name":"CVE-2024-43649","record":{"aliases":["GHSA-3wph-r629-c94g"],"analysis":{"component_type":"iot_embedded","fix_type":"upgrade","impacts":["code_execution","privilege_escalation"],"network_reachable":"yes","non_default_config":false,"product_category":"EV charger firmware","requires_auth":"low_privilege","summary":"Authenticated attackers can execute arbitrary commands as root on Iocharger EV chargers via a filename parameter, leading to full device compromise.","user_interaction":"not_required","vuln_class":"command_injection"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"DIVD","cpe":[],"cvss":{"score":9.3,"severity":"critical","source":"cna","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:H/S:P/AU:Y","version":"4.0"},"cwes":[{"id":"CWE-78","name":"Improper Neutralization of Special Elements used in an OS Command"},{"id":"CWE-250","name":"Execution with Unnecessary Privileges"}],"description":"Authenticated command injection in the filename of a \u003credacted\u003e.exe request leads to remote code execution as the root user.\n\nThis issue affects Iocharger firmware for AC models before version 24120701.\n\nLikelihood: Moderate – This action is not a common place for command injection vulnerabilities to occur. Thus, an attacker will likely only be able to find this vulnerability by reverse-engineering the firmware or trying it on all \u003credacted\u003e fields. The attacker will also need a (low privilege) account to gain access to the \u003credacted\u003e binary, or convince a user with such access to execute a payload.\n\nImpact: Critical – The attacker has full control over the charging station as the root user, and can arbitrarily add, modify and delete files and services.\n\nCVSS clarification: This attack can be performed over any network conenction serving the web interfacr (AV:N), and there are not additional mitigating measures that need to be circumvented (AC:L) or other prerequisites (AT:N). The attack does require privileges, but the level does not matter (PR:L), there is no user interaction required (UI:N). The attack leeds to a full compromised of the charger (VC:H/VI:H/VA:H) and a compromised charger can be used to \"pivot\" to networks that should normally not be reachable (SC:L/SI:L/SA:H). Because this is an EV chargers with significant pwoer, there is a potential safety imp0act (S:P). THis attack can be automated (AU:Y).","ecosystems":[],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"none_known"},"has_fix":null,"headline":"Authenticated command injection via \u003credacted\u003e.exe \u003credacted\u003e parameter","id":"CVE-2024-43649","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":null,"product":null,"products":[],"type":"command_injection","year":"2024"},"n_packages":0,"n_references":3,"next":{"headline":"Command injection in Iocharger firmware for AC models","id":"CVE-2024-43650"},"packages":[],"prev":{"headline":"Authenticated command injection via \u003credacted\u003e.exe \u003credacted\u003e parameter","id":"CVE-2024-43648"},"products":["Iocharger firmware for AC models"],"published":"2025-01-09","related":[],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"CWE Terms of Use","name":"CWE (MITRE)"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"}],"ssvc":{"automatable":"no","exploitation":"none","technical_impact":"total"},"state":"PUBLISHED","updated":"2025-03-11","vendors":["Iocharger"]},"summary":"Authenticated attackers can execute arbitrary commands as root on Iocharger EV chargers via a filename parameter, leading to full device compromise.","url":"https://insights.sbomify.com/CVE-2024-43649/"}