CVE-2024-28136

A local attacker with low privileges can use a command injection vulnerability to gain root privileges due to improper input validation using the OCPP Remote service.

Score

CVSS 3.1 7.8 High

Status

Modified - info@cert.vde.com

Published

2024-05-14

Last modified

2025-01-24

Weaknesses

CWE-77

Affected products

• Charx Sec-3000 (Phoenix Contact)
• Charx Sec-3050 (Phoenix Contact)
• Charx Sec-3100 (Phoenix Contact)
• Charx Sec-3150 (Phoenix Contact)
• Charx Sec-3000 Firmware (Phoenixcontact)
• Charx Sec-3050 Firmware (Phoenixcontact)
• Charx Sec-3100 Firmware (Phoenixcontact)
• Charx Sec-3150 Firmware (Phoenixcontact)
• Charx Sec 3000 (Phoenixcontact)
• Charx Sec 3050 (Phoenixcontact)
• Charx Sec 3100 (Phoenixcontact)
• Charx Sec 3150 (Phoenixcontact)

References

• https://cert.vde.com/en/advisories/VDE-2024-019