CVE-2024-5684 ID Charger Connect & Pro - JWT-Null-Algorithm
A local attacker can bypass authentication on EV chargers by exploiting a JWT library misconfiguration that accepts the 'none' algorithm.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2024-5684?
CVE-2024-5684 is a medium-severity authentication bypass vulnerability in Volkswagen Group Charging GmbH - Elli, EVBox ID Charger Connect & Pro, published on 6 Jun 2024. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
An attacker with access to the private network (the charger is connected to) or local access to the Ethernet-Interface can exploit a faulty implementation of the JWT-library in order to bypass the password authentication to the web configuration interface and then has full access as the user would have. However, an attacker will not have developer or admin rights. If the implementation of the JWT-library is wrongly configured to accept "none"-algorithms, the server will pass insecure JWT. A local, unauthenticated attacker can exploit this vulnerability to bypass the authentication mechanism.
Weakness: CWE-345
Which versions are affected by CVE-2024-5684?
It affects 2 products.
Products include Vw Id.charger Connect Firmware, Vw Id.charger Pro Firmware.
How do I fix CVE-2024-5684?
No fix has been published for CVE-2024-5684 yet. Limit exposure of the affected software until one is available.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2024-5684 being exploited?
There is no known exploitation of CVE-2024-5684 in the wild and no public exploit code.
Sources
Also known as GHSA-f2cq-m485-xq43.