Medium · 5.9 CVE-2024-44843 EUVD-2024-54414GHSA-g2fr-wj73-rxrw

An issue in the web socket handshake process of SteVe v3.7.1 allows attackers to bypass authentication and execute arbitrary coammands via …

Published Apr 15, 2025 · Updated Apr 16, 2025 · Assigned by mitre

Description

An issue in the web socket handshake process of SteVe v3.7.1 allows attackers to bypass authentication and execute arbitrary coammands via supplying crafted OCPP requests.

References

https://github.com/steve-community/steve/issues/1546
https://github.com/steve-community/steve/blob/master/src/main/java/de/rwth/idsg/steve/ocpp/ws/OcppWebSocketHandshakeHandler.java
https://gist.github.com/Badranh/94359664799db6d4709871f0c353f476