Back to Database
Status published
Unknown
CVE-2025-27804
OS Command Injection Vulnerability in eCharge Hardy Barth cPH2 / cPP2 charging stations
Vulnerability Description
Several OS command injection vulnerabilities exist in the device firmware in the /var/salia/mqtt.php script. By publishing a specially crafted message to a certain MQTT topic arbitrary OS commands can be executed with root permissions.
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
THREAT MONITOR
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-27804
Credits & Attribution
The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:
- Stefan Viehböck | SEC Consult Vulnerability Lab
References
More from eCharge Hardy Barth
View All →CVE-2025-5873
eCharge Hardy Barth Salia PLCC Web UI firmware.php unrestricted upload
Medium
5.3
CVE-2025-48417
Hard-Coded Certificate and Private Key for HTTPS Web Interface in eCharge Hardy Barth cPH2 / cPP2 charging stations
Unknown
0
CVE-2025-48416
Backdoor Functionality via SSH in eCharge Hardy Barth cPH2 / cPP2 charging stations
Unknown
0
CVE-2025-48415
Backdoor Functionality via USB Drive in eCharge Hardy Barth cPH2 / cPP2 charging stations
Unknown
0
CVE-2025-48414
Hard-coded web interface credentials in eCharge Hardy Barth cPH2 / cPP2 charging stations
Unknown
0
Affected Vendor
eCharge Hardy Barth
View all reports →Affected Software
cPH2 / cPP2 charging stations
Vulnerable Versions:
<=2.2.0
Timeline
Official Publish:
May 21st, 2025
Last Modified:
November 3rd, 2025
Added to House:
July 22nd, 2026
CVSS Vectors
No vector data available