CVE-2024-11666 - CVE House
Back to Database
Status published Critical CVE-2024-11666

Unauthenticated Remote Command Injection in eCharge Salia PLCC

Vulnerability Description

Affected devices beacon to eCharge cloud infrastructure asking if there are any command they should run. This communication is established over an insecure channel since peer verification is disabled everywhere. Therefore, remote unauthenticated users  suitably positioned on the network between an EV charger controller and eCharge infrastructure can execute arbitrary commands with elevated privileges on affected devices. This issue affects cph2_echarge_firmware: through 2.0.4.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2024-11666

Credits & Attribution

The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:

  • Quentin Kaiser from ONEKEY Research Labs

References

More from hardy-barth

View All →
CVE-2024-11665
Unauthenticated Remote Command Injection
High 8.8

Affected Vendor

hardy-barth

View all reports →

Affected Software

cph2_echarge_firmware
Vulnerable Versions:
0

Timeline

Official Publish: November 24th, 2024
Last Modified: November 25th, 2024
Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

Weaknesses (CWE)

CWE-345

MITRE ATT&CK TTPs

T1557 Adversary-in-the-Middle
Credential Access
T1071 Application Layer Protocol
Command and Control
T1552 Unsecured Credentials
Credential Access
T1190 Exploit Public-Facing Application
Initial Access
T1041 Exfiltration Over C2 Channel
Exfiltration