{"id":"CVE-2020-8007","state":"PUBLISHED","title":"The pwrstudio web application of EV Charger (in the server in Circontrol Raption through 5.6.2) is vulnerable to OS command injection via three fields of the configuration menu for","description":"The pwrstudio web application of EV Charger (in the server in Circontrol Raption through 5.6.2) is vulnerable to OS command injection via three fields of the configuration menu for ntpserver0, ntpserver1, and pingip.","publishedAt":"2024-11-08T00:00:00.000Z","updatedAt":"2025-11-04T18:14:16.990Z","severity":{"score":9.8,"label":"Critical","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","source":"CISA-ADP"},"assigner":"mitre","products":["n/a n/a"],"affected":[{"vendor":"n/a","product":"n/a","versions":[{"version":"n/a","status":"affected"}]}],"references":["https://circontrol.com/intelligent-charging-solutions/dc-chargers-series/raption-150/","https://seclists.org/fulldisclosure/2024/Mar/33","http://seclists.org/fulldisclosure/2024/Mar/33"],"weaknesses":["CWE-78"],"ingestedAt":"2026-10-29T19:47:44.297Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2020/8xxx/CVE-2020-8007.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2020-8007","state":"PUBLISHED","datePublished":"2024-11-08T00:00:00.000Z","dateUpdated":"2025-11-04T18:14:16.990Z","assignerShortName":"mitre","assignerOrgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","dateReserved":"2020-01-27T00:00:00.000Z"},"containers":{"cna":{"descriptions":[{"lang":"en","value":"The pwrstudio web application of EV Charger (in the server in Circontrol Raption through 5.6.2) is vulnerable to OS command injection via three fields of the configuration menu for ntpserver0, ntpserver1, and pingip."}],"affected":[{"vendor":"n/a","product":"n/a","versions":[{"version":"n/a","status":"affected"}]}],"references":[{"url":"https://circontrol.com/intelligent-charging-solutions/dc-chargers-series/raption-150/"},{"url":"https://seclists.org/fulldisclosure/2024/Mar/33"}],"problemTypes":[{"descriptions":[{"type":"text","lang":"en","description":"n/a"}]}],"providerMetadata":{"shortName":"mitre","orgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","dateUpdated":"2024-11-08T04:06:29.316Z"}},"adp":[{"title":"CISA ADP Vulnrichment","affected":[{"vendor":"pwrstudio","product":"ev_charger","defaultStatus":"unknown","versions":[{"version":"0","status":"affected","lessThanOrEqual":"5.6.2","versionType":"custom"}],"cpes":["cpe:2.3:a:pwrstudio:ev_charger:*:*:*:*:*:*:*:*"]}],"metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":9.8,"attackVector":"NETWORK","baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"HIGH"}},{"other":{"type":"ssvc","content":{"timestamp":"2024-11-08T15:12:26.430818Z","id":"CVE-2020-8007","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-78","type":"CWE","lang":"en","description":"CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')"}]}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2024-11-08T15:16:05.106Z"}},{"title":"CVE Program Container","references":[{"url":"http://seclists.org/fulldisclosure/2024/Mar/33"}],"providerMetadata":{"shortName":"CVE","orgId":"af854a3a-2127-422b-91ae-364da2661108","dateUpdated":"2025-11-04T18:14:16.990Z"}}]}}}