ID Charger Connect & Pro - JWT-Null-Algorithm
Vulnerability Description
An attacker with access to the private network (the charger is connected to) or local access to the Ethernet-Interface can exploit a faulty implementation of the JWT-library in order to bypass the password authentication to the web configuration interface and then has full access as the user would have. However, an attacker will not have developer or admin rights. If the implementation of the JWT-library is wrongly configured to accept "none"-algorithms, the server will pass insecure JWT. A local, unauthenticated attacker can exploit this vulnerability to bypass the authentication mechanism.
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2024-5684
Credits & Attribution
The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:
- Anna Breeva (PCAutomotive)
Affected Vendor
Volkswagen Group Charging GmbH - Elli, EVBox
View all reports →