Frank Breedijk (DIVD)

Authenticated command injection in the <redacted> action leads to full remote code execution as root on the charging station

Authenticated command injection via <redacted>.exe <redacted> parameter

Plaintext default credentials in firmware

Authenticated command injection in the <redacted> action leads to full remote code execution as root on the charging station

Using the <redacted> action or <redacted>.sh script, arbitrary files and directories can be deleted using directory traversal.

Authenticated command injection in the <redacted> action leads to full remote code execution as root on the charging station

Authenticated command injection via <redacted>.exe <redacted> parameter

Buffer overflow in <redacted>.so leads to DoS of OCPP service