CVE-2025-27804
OS Command Injection Vulnerability in eCharge Hardy Barth cPH2 / cPP2 charging stations
We use these services and cookies to improve your user experience. You may opt out if you wish, however, this may limit some features on this site.
Please see our statement on Data Privacy.
OS Command Injection Vulnerability in eCharge Hardy Barth cPH2 / cPP2 charging stations
Several OS command injection vulnerabilities exist in the device firmware in the /var/salia/mqtt.php script. By publishing a specially crafted message to a certain MQTT topic arbitrary OS commands can be executed with root permissions.
Reserved 2025-03-07 | Published 2025-05-21 | Updated 2025-05-21 | Assigner SEC-VLabCWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Stefan Viehböck | SEC Consult Vulnerability Lab
r.sec-consult.com/echarge
Support options
