eCharge Hardy Barth cPH2 Command Injection Remote Code Execution Vulnerability

A command injection vulnerability allowing remote code execution has been identified in eCharge Hardy Barth cPH2 charging stations. This issue arises in the check_req.php endpoint, where the ntp parameter is not properly validated before being used in a system call. As a result, network-adjacent attackers can execute arbitrary code on the affected devices, with the executed code running under the www-data user. Notably, no authentication is required to exploit this vulnerability.

Impact

Exploitation of this vulnerability allows for arbitrary code execution on the affected charging stations, with the executed code running in the context of the www-data user.