Read the docs
TI-2024-29280 Aliases CVE-2024-43658GHSA-899w-xjmf-9r94

Using the <redacted> action or <redacted>.sh script, arbitrary files and directories can…

Priority LOW 32CWE-27Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
—
Confidentiality · integrity · availability
None · High · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA.

Summary

Patch traversal, External Control of File Name or Path vulnerability in Iocharger Home allows deletion of arbitrary files This issue affects Iocharger firmware for AC model before firmware version 25010801. Likelihood: High, but requires authentication Impact: Critical – The vulnerability can be used to delete any file on the charging station, severely impacting the integrity of the charging station. Furthermore, the vulnerability could be used to delete binaries required for the functioning of the charging station, severely impacting the availability of the charging station. CVSS clarification: Any network interface serving the web ui is vulnerable (AV:N) and there are not additional security measures to circumvent (AC:L), nor does the attack require and existing preconditions (AT:N). The attack is authenticated, but the level of authentication does not matter (PR:L), nor is any user interaction required (UI:N). The attack leads compromised of the integrity and availability of the device (VVC:N/VI:H/VA:H), with no effect on subsequent systems (SC:N/SI:N/SA:N). We do not forsee a safety impact (S:N). This attack can be automated (AU:Y).

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00555 46th percentileScored 2026-11-07
Fix Fixed Iocharger firmware for AC models (Iocharger): 25010801

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
IochargerIocharger firmware for AC modelsbefore 2501080125010801Patch availableCNA
  • Iocharger firmware for AC models VendorIocharger Affected before 25010801 Fixed in 25010801 Patch available CNA

Remediation

  • Fix · CNA Iocharger firmware for AC models (Iocharger) Fixed in 25010801

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    Iocharger firmware for AC models 25010801

    3 records Highest priority Priority MEDIUM 2 MEDIUM, 1 LOW

    Other records, highest priority first

    • TI-2024-29276 OS command injection in Iocharger firmware for AC modelsPriority MEDIUM 46
    • TI-2024-29281 Plaintext default credentials in firmwarePriority MEDIUM 40
    Show all 3 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2024-43658
  2. 2026-10-03 Alias added: GHSA-899w-xjmf-9r94

References

Advisory 2

Other 1

  • TI-2024-29276 OS command injection in Iocharger firmware for AC models CVSS 4.0CRITICAL 9.3
  • TI-2024-29275 OS command injection in Iocharger firmware for AC models CVSS 4.0CRITICAL 9.3
  • TI-2024-29274 OS command injection in Iocharger firmware for AC chargers CVSS 4.0CRITICAL 9.3
  • TI-2024-29273 OS command injection in Iocharger firmware for AC models CVSS 4.0CRITICAL 9.3
  • TI-2024-29271 Authenticated command injection via <redacted>.exe <redacted> parameter CVSS 4.0CRITICAL 9.3
  • TI-2024-29270 Authenticated command injection via <redacted>.exe <redacted> parameter CVSS 4.0CRITICAL 9.3
See all 15 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences