CVE-2025-27804

Several OS command injection vulnerabilities exist in the device firmware in the /var/salia/mqtt.php script. By publishing a specially crafted message to a certain MQTT topic arbitrary OS commands can be executed with root permissions.

Score

CVSS 3.1 6.5 Medium

Status

Deferred - 551230f0-3615-47bd-b7cc-93e92e730bbf

Published

2025-05-21

Last modified

2025-11-03

Weaknesses

CWE-78

Affected products

• Cph2 Cpp2 Charging Stations (Echarge Hardy Barth)

References

• https://r.sec-consult.com/echarge
• http://seclists.org/fulldisclosure/2025/May/23