{"answers":{"affected":"","exploited":"There is no known exploitation of CVE-2024-43659 in the wild and no public exploit code.","fix":"No fix has been published for CVE-2024-43659 yet. Limit exposure of the affected software until one is available.","what":"CVE-2024-43659 is a high-severity vulnerability in Iocharger firmware for AC models, published on 9 Jan 2025. It can only be exploited from the same machine or local network, with no action from the victim."},"fix_prompt":"Check this codebase for CVE-2024-43659 and fix it if it is affected.\n\nWhat it is: CVE-2024-43659 is a high-severity vulnerability in Iocharger firmware for AC models, published on 9 Jan 2025. It can only be exploited from the same machine or local network, with no action from the victim.\nExploitation: There is no known exploitation of CVE-2024-43659 in the wild and no public exploit code.\n\nAffected product: Iocharger firmware for AC models. No package-level version data is available, so check the vendor advisory linked from the reference page.\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2024-43659/ (Markdown: https://insights.sbomify.com/CVE-2024-43659/index.md)","id":"CVE-2024-43659","markdown":"https://insights.sbomify.com/CVE-2024-43659/index.md","name":"CVE-2024-43659","record":{"aliases":["GHSA-qxc8-hg93-pqh7"],"analysis":{"component_type":"iot_embedded","fix_type":"patch","impacts":["account_takeover","code_execution"],"network_reachable":"adjacent_or_local","non_default_config":false,"product_category":"EV charging station firmware","requires_auth":"high_privilege","summary":"Attackers can extract hardcoded default credentials from firmware to log into EV chargers and execute arbitrary commands, risking safety and control.","user_interaction":"not_required","vuln_class":"hardcoded_credentials"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"DIVD","cpe":[],"cvss":{"score":8.3,"severity":"high","source":"cna","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:H/SI:H/SA:H/S:P/AU:N","version":"4.0"},"cwes":[{"id":"CWE-256","name":"Plaintext Storage of a Password"},{"id":"CWE-1393","name":"Use of Default Password"},{"id":"CWE-1391","name":"Use of Weak Credentials"}],"description":"After gaining access to the firmware of a charging station, a file at \u003credacted\u003e can be accessed to obtain default credentials that are the same across all Iocharger AC model EV chargers.\n\nThis issue affects Iocharger firmware for AC models before firmware version 25010801. \n\nThe issue is addressed by requiring a mandatory password change on first login, it is still recommended to change the password on older models.\n\nLikelihood: Moderate – The attacker will first have to abuse a code execution or file inclusion vulnerability (for example by using \u003credacted\u003e.sh) to gain access to the \u003credacted\u003e.json file, or obtain a firmware dump of the charging station or obtain the firmware via other channels.\n\nImpact: Critical – All chargers using Iocharger firmware for AC models started with the same initial password. For models with firmware version before 25010801 a password change was not mandatory. It is therefore very likely that this firmware password is still active on many chargers. These credentials could, once obtained, allow an attacker to log into many Iocharger charging station, and allow them to execute arbitrary commands via the System → Custom page.\n\nCVSS clarification: Any network interface serving the web ui is vulnerable (AV:N) and there are not additional security measures to circumvent (AC:L), nor does the attack require and existing preconditions (AT:N). The attack is authenticated, and requires high privileges (PR:H), there is no user interaction required (UI:N). The attack leads to a compromised of the confidentialy of the \"super user\" credentials of the device (VC:H/VI:N/VA:N), and can subsequently be used to full compromise and other devices (SC:H/SI:H/SA:H). Becuase this is an EV charger handing significant power, there is a potential safety impact (S:P). This attack can be automated (AU:Y).","ecosystems":[],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"none_known"},"has_fix":null,"headline":"Plaintext default credentials in firmware","id":"CVE-2024-43659","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":null,"product":null,"products":[],"type":"hardcoded_credentials","year":"2024"},"n_packages":0,"n_references":3,"next":{"headline":"Arbitrary file download using \u003credacted\u003e.sh","id":"CVE-2024-43660"},"packages":[],"prev":{"headline":"Path traversal in Iocharger firmware for AC models","id":"CVE-2024-43658"},"products":["Iocharger firmware for AC models"],"published":"2025-01-09","related":[],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"CWE Terms of Use","name":"CWE (MITRE)"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"}],"ssvc":{"automatable":"no","exploitation":"none","technical_impact":"total"},"state":"PUBLISHED","updated":"2025-03-11","vendors":["Iocharger"]},"summary":"Attackers can extract hardcoded default credentials from firmware to log into EV chargers and execute arbitrary commands, risking safety and control.","url":"https://insights.sbomify.com/CVE-2024-43659/"}