CVE-2024-43661

Technical Description

The <redacted>.so library, which is used by <redacted>, is

vulnerable to a buffer overflow in the code that handles the deletion

of certificates. This buffer overflow can be triggered by providing a

long file path to the <redacted> action of the <redacted>.exe CGI binary or

to the <redacted>.sh CGI script. This binary or script will write this

file path to <redacted>, which is then

read by <redacted>.so

This issue affects Iocharger firmware for AC models before version 24120701.

Likelihood: Moderate – An attacker will have to find this exploit by

either obtaining the binaries involved in this vulnerability, or by trial

and error. Furthermore, the attacker will need a (low privilege)

account to gain access to the <redacted>.exe CGI binary or <redacted>.sh

script to trigger the vulnerability, or convince a user with such access

send an HTTP request that triggers it.

Impact: High – The <redacted> process, which we assume is

responsible for OCPP communication, will keep crashing after

Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

References