Skip to content
CVE PROGRAM SOURCE RECORD6.5 Medium

CVE-2025-27804

OS Command Injection Vulnerability in eCharge Hardy Barth cPH2 / cPP2 charging stations

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
SEC-VLab

Description

Several OS command injection vulnerabilities exist in the device firmware in the /var/salia/mqtt.php script. By publishing a specially crafted message to a certain MQTT topic arbitrary OS commands can be executed with root permissions.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

eCharge Hardy Barth cPH2 / cPP2 charging stations

Default version status: affected

  • <=2.2.0affected

References