eCharge Hardy Barth cPH2 Command Injection Remote Code Execution Vulnerability

A command injection vulnerability allowing remote code execution has been identified in eCharge Hardy Barth cPH2 charging stations. This issue arises from improper validation of user-supplied strings in GET parameters sent to the index.php endpoint, enabling network-adjacent attackers to execute arbitrary code as the www-data user. Notably, no authentication is required to exploit this vulnerability.

Impact

Exploitation of this vulnerability allows for arbitrary code execution on the affected system, with the executed code running in the context of the www-data user.