eCharge Hardy Barth cPH2 Command Injection Remote Code Execution Vulnerability

A remote code execution vulnerability has been identified in eCharge Hardy Barth cPH2 charging stations. This issue arises in the nwcheckexec.php endpoint, where the dest parameter is not properly validated before being used in a system call. As a result, network-adjacent attackers can execute arbitrary code on the affected devices, with the executed code running under the www-data user. Notably, no authentication is required to exploit this vulnerability.

Impact

Exploitation of this vulnerability allows for arbitrary code execution on the affected charging stations, with the executed code running in the context of the www-data user.