Wilco van Beijnum

Arbitrary file download using <redacted>.sh

Authenticated arbitrary file upload to /tmp/ and /tmp/upload/

When uploading new firmware, a shell script inside a firmware file is executed during its processing. This can be used to craft a custom firmware file with a custom script with arbitrary code, which will then be executed on the charging station.

Authenticated command injection in the <redacted> action leads to full remote code execution as root on the charging station

Authenticated command injection via <redacted>.exe <redacted> parameter

Plaintext default credentials in firmware

Authenticated command injection in the <redacted> action leads to full remote code execution as root on the charging station

Using the <redacted> action or <redacted>.sh script, arbitrary files and directories can be deleted using directory traversal.

Authenticated command injection in the <redacted> action leads to full remote code execution as root on the charging station

Authenticated command injection via <redacted>.exe <redacted> parameter