Mennekes Smart/Premium Charging Systems Command Injection Vulnerability in Time Setting
Vulnerability
A command injection vulnerability has been identified in Mennekes Smart and Premium Charging Stations, specifically in the authenticated time setting feature. This issue arises because the firmware improperly neutralizes OS commands when certain fields are transmitted to the underlying operating system, allowing for arbitrary command execution.
Impact
Exploitation of this vulnerability allows authenticated users to execute arbitrary OS commands on the charging station's firmware.
Remediation
Users are advised to update the firmware to version 2.15 or later. The latest firmware can be downloaded from the Mennekes Software Updates page.
Vulnerability Rating
Our algorithm analyzes dozens of metrics to generate these 8 key vulnerability categories, which are then combined to calculate the overall risk score.