CVE-2024-11666

published 2024-11-24

CVE-2024-11666: Affected devices beacon to eCharge cloud infrastructure asking if there are any command they should run. This communication is established over an insecure…

Priority P2 67 critical 9.8 CVSS 3.1

AV N AC L PR N UI N S U C H I H A H

Affected devices beacon to eCharge cloud infrastructure asking if there are any command they should run. This communication is established over an insecure channel since peer verification is disabled everywhere. Therefore, remote unauthenticated users suitably positioned on the network between an EV charger controller and eCharge infrastructure can execute arbitrary commands with elevated privileges on affected devices.

This issue affects cph2_echarge_firmware: through 2.0.4.

Affected

2 ranges

Vendor	Product	Version range	Fixed in
echarge	salia_plcc_firmware	<= 2.0.4	—
hardy-barth	cph2_echarge_firmware	<= 2.0.4	—

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-345