Summary
Multiple vulnerabilities have been discovered in the Firmware of CHARX SEC charge controllers.
Update: credis have been updated
Details
Impact
CVE-2024-28137: The exploit allows a local user to gain root privileges, which allows them to take over the device.
CVE-2024-28134: The exploit allows an attacker without local account to get access to the web-basedmanagement with the privileges of the currently logged in user.
CVE-2024-28135: The exploit allows a user of the web-based management to perform remote code execution on the device as a user with low privileges.
CVE-2024-28133: The exploit allows a local user on the device to perform privilege escalation to gain rootprivileges.
CVE-2024-28136: When the OCPP management port is opened, the exploit allows an attacker without localaccount to gain root privileges and perform remote code execution.
Mitigation
Phoenix Contact recommends operating network-capable devices in closed networks orprotected with a suitable firewall. For detailed information on our recommendations for measuresto protect network-capable devices, please refer to our application note.
Measures to protect network-capable devices with Ethernet connection
Remediation
PHOENIX CONTACT strongly recommends upgrading affected charge controllers to firmware version 1.6 which fixes these vulnerabilities.
Vulnerabilities 5
-
High 7.8
PHOENIX CONTACT: Privilege escalation in CHARX Series
A local low privileged attacker can use an untrusted search path in a CHARX system utility to gain root privileges.
-
High 7.8
PHOENIX CONTACT: command injection gains root privileges using the OCPP remote service
A local attacker with low privileges can use a command injection vulnerability to gain root privileges due to improper input validation using the OCPP Remote service.
-
High 7.8
PHOENIX CONTACT: privilege escalation due to a TOCTOU vulnerability in the CHARX Series
A local attacker with low privileges can perform a privilege escalation with an init script due to a TOCTOU vulnerability.
-
High 7.0
PHOENIX CONTACT: MitM attack gains privileges of the current logged in user in CHARX Series
An unauthenticated remote attacker can extract a session token with a MitM attack and gain web-based management access with the privileges of the currently logged in user due to cleartext transmission of sensitive information. No additional user interaction i…
-
Medium 5.0
PHOENIX CONTACT: command injection vulnerability in the API of the CHARX Series
A low privileged remote attacker can use a command injection vulnerability in the API which performs remote code execution as the user-app user due to improper input validation. The confidentiality is partly affected.
Revision history
-
#1
Initial revision.
References
-
VDE-2024-019: Phoenix Contact: Multiple vulnerabilities in the Firmware of CHARX SEC charge controllers - HTML
https://certvde.com/en/advisories/VDE-2024-019/
-
Vendor PSIRT
https://phoenixcontact.com/psirt
-
CERT@VDE Security Advisories for Phoenix Contact GmbH & Co. KG
https://certvde.com/en/advisories/vendor/phoenixcontact/