Read the docs
TI-2024-29273 Aliases CVE-2024-43651GHSA-94gh-gf9p-r6hq

OS command injection in Iocharger firmware for AC models

Priority MEDIUM 46CWE-250Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Privilege escalation, Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-250 and CWE-78.

Summary

Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability allows OS Command Injection as root This issue affects Iocharger firmware for AC models before version 241207101 Likelihood: Moderate – The <redacted> binary does not seem to be used by the web interface, so it might be more difficult to find. It seems to be largely the same binary as used by the Iocharger Pedestal charging station, however. The attacker will also need a (low privilege) account to gain access to the <redacted> binary, or convince a user with such access to execute a crafted HTTP request. Impact: Critical – The attacker has full control over the charging station as the root user, and can arbitrarily add, modify and delete files and services. CVSS clarification: Any network connection serving the web interface is vulnerable (AV:N) and there are no additional measures to circumvent (AC:L) nor does the attack require special conditions to be present (AT:N). The attack requires authentication, but the level does not matter (PR:L), nor is user interaction required (UI:N). The attack leads to a full compromised (VC:H/VI:H/VA:H) and a compromised device can be used to potentially "pivot" into a network that should nopt be reachable (SC:L/SI:L/SA:H). Because this is an EV charger handing significant power, there is a potential safety impact (S:P). THe attack can be autometed (AU:Y).

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.01762 78th percentileScored 2026-11-07
Fix Fixed Iocharger firmware for AC models (Iocharger): 24120701

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
IochargerIocharger firmware for AC modelsbefore 2412070124120701Patch availableCNA
  • Iocharger firmware for AC models VendorIocharger Affected before 24120701 Fixed in 24120701 Patch available CNA

Remediation

  • Fix · CNA Iocharger firmware for AC models (Iocharger) Fixed in 24120701

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    Iocharger firmware for AC models 24120701

    11 records Highest priority Priority MEDIUM 8 MEDIUM, 3 LOW

    Other records, highest priority first

    • TI-2024-29275 OS command injection in Iocharger firmware for AC modelsPriority MEDIUM 46
    • TI-2024-29271 Authenticated command injection via <redacted>.exe <redacted> parameterPriority MEDIUM 46
    • TI-2024-29270 Authenticated command injection via <redacted>.exe <redacted> parameterPriority MEDIUM 46
    Show all 11 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2024-43651
  2. 2026-10-03 Alias added: GHSA-94gh-gf9p-r6hq

References

Advisory 2

Other 1

  • TI-2024-29276 OS command injection in Iocharger firmware for AC models CVSS 4.0CRITICAL 9.3
  • TI-2024-29275 OS command injection in Iocharger firmware for AC models CVSS 4.0CRITICAL 9.3
  • TI-2024-29274 OS command injection in Iocharger firmware for AC chargers CVSS 4.0CRITICAL 9.3
  • TI-2024-29271 Authenticated command injection via <redacted>.exe <redacted> parameter CVSS 4.0CRITICAL 9.3
  • TI-2024-29270 Authenticated command injection via <redacted>.exe <redacted> parameter CVSS 4.0CRITICAL 9.3
  • TI-2024-29279 Unrestricted file upload in Iocharger firmware for AC models CVSS 4.0CRITICAL 9.3
See all 15 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences