| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Date: Tue, 26 Mar 2024 09:14:31 +0100 From: Dariusz G <dariusz.gonda@...il.com> To: fulldisclosure@...lists.org Subject: [FD] Circontrol EV Charger vulnerabilities (CVE-2020-8006, CVE-2020-8007) Circontrol EV Charger vulnerabilities. 1. CVE-2020-8006 Pre-Auth Stack Based Buffer Overflow CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H (10) The server in Circontrol Raption through 5.11.2 has a pre-authentication stack-based buffer overflow that can be exploited to gain run-time control of the device as root. When the server parses the HTTP headers and finds the Basic-Authentication tag it will call a base64 decode function. This function takes 3 arguments: an input pointer, an output pointer and a length. During the authentication flow, the input pointer can be an attacker controlled string of approximately 4096 characters, and the output pointer is located on the stack, the length argument is 512. While the length of the stack based buffer is passed to the decoder it only verifies that it is not smaller than 3. [Vendor of Product] https://circontrol.com/ [Affected Product Code Base] Raption Server - Raption up to 5.11.2 [Affected Component] OCCP 1.5, OCCP.1.6, PWRSTUDIO [Attack Type] Remote [Impact Code execution] true [Impact Denial of Service] true [Attack Vectors] Remote [Has vendor confirmed or acknowledged the vulnerability?] true [Discoverer] Abert Spruyt, Alex Salvetti, Dariusz Gońda [Reference] https://circontrol.com/intelligent-charging-solutions/dc-chargers-series/raption-150/ 2. CVE-2020-8007 - Command injection (RCE/authenticated) CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L (9.1) The pwrstudio web application of EV Charger (in the server in Circontrol Raption through 5.6.2) is vulnerable to OS command injection via three fields of the configuration menu for ntpserver0, ntpserver1, and pingip. [VulnerabilityType Other] Command Injection [Vendor of Product] https://circontrol.com/ [Affected Product Code Base] Raption Server - up to 5.6.2 [Affected Component] pwrstudio [Attack Type] Remote [Impact Code execution] true [Attack Vectors] To exploit this issue authorization is required. [Has vendor confirmed or acknowledged the vulnerability?] true [Discoverer] Abert Spruyt, Alex Salvetti, Dariusz Gońda [Reference] https://circontrol.com/intelligent-charging-solutions/dc-chargers-series/raption-150/ _______________________________________________ Sent through the Full Disclosure mailing list https://nmap.org/mailman/listinfo/fulldisclosure Web Archives & RSS: https://seclists.org/fulldisclosure/
Powered by blists - more mailing lists