CVE-2023-46359

What it actually does

This vulnerability is an unauthenticated remote OS command injection flaw in the Hardy Barth cPH2 eCharge Ladestation connectivity check feature. User-controlled arguments supplied to the connectivity check are insufficiently sanitized before being passed to an operating-system command, allowing an attacker to append shell metacharacters or commands and execute arbitrary commands on the underlying system. Because exploitation requires network access only, no credentials, and no user interaction, successful exploitation can provide full compromise of the charging station operating environment, including command execution, file access, configuration tampering, malware deployment, service disruption, and pivoting to reachable internal systems. The provided package data also references Debian 11 Linux fixes at version 5.10.223-1; affected deployments should verify both the charging station application firmware/software level and the underlying OS package state.

Why it matters to the business

An exposed vulnerable charging station can be remotely taken over, disrupted, or altered by an attacker, potentially causing charger outages, unsafe or unreliable charging operations, loss of billing or operational data, unauthorized network access, and reputational damage. The risk is elevated because the vulnerability has a critical CVSS score, a high EPSS probability, weaponized exploit maturity, and has been public for an extended period, increasing the likelihood that internet-exposed systems have already been scanned or targeted even though it is not currently listed in CISA KEV.

How an attack unfolds

An attacker first identifies an internet- or network-reachable Hardy Barth cPH2 eCharge Ladestation running version 1.87.0 or earlier. The attacker then sends a crafted request to the connectivity check feature with malicious input embedded in an argument that the application later passes to an operating-system command. By inserting shell control characters and additional commands, the attacker causes the device to execute attacker-chosen commands instead of only performing the intended connectivity test. Initial commands are commonly used to confirm code execution, identify the user context, enumerate the system, or retrieve additional payloads. After confirming execution, the attacker may install persistence, add SSH keys or users, download malware, modify charger configuration, exfiltrate data, disrupt charging services, or use the device as a foothold into adjacent networks.

How to fix it

Upgrade affected Hardy Barth cPH2 eCharge Ladestation deployments to a vendor-provided fixed firmware or software release newer than v1.87.0 as soon as available. Where Debian 11 Linux packages are in scope, update to the fixed package version 5.10.223-1 or later and reboot where required so the fixed kernel/package is active. If immediate upgrade is not possible, restrict access to the charging station management interface and connectivity check feature using firewall rules, VPN-only access, management VLANs, or allowlisted administrative IP ranges. Disable or block the connectivity check feature if operationally feasible until patched. Remove direct internet exposure, enforce strong administrative access controls, and monitor for unexpected outbound connections from charging stations. As a defense-in-depth measure, ensure command invocation in custom integrations avoids shell interpretation and validates connectivity-check input against a strict allowlist.

How to confirm the fix worked

Confirm the installed charging station firmware/software version is newer than Hardy Barth cPH2 eCharge Ladestation v1.87.0 or otherwise documented by the vendor as fixed. For Debian 11 package exposure, verify the installed package version is 5.10.223-1 or later and confirm the running kernel/package state reflects the update after reboot. Validate that the management interface and connectivity check endpoint are not reachable from untrusted networks. Perform a safe, authorized test using non-destructive metacharacter input to confirm the connectivity check does not execute appended commands and only accepts expected host or address values. Review firewall and network policy to verify only authorized management sources can access the device. Confirm monitoring is in place for suspicious connectivity check requests, unexpected shell process creation, and outbound connections from the charging station.

Typical attack path

1. Scan for exposed Hardy Barth cPH2 eCharge Ladestation management interfaces or connectivity check functionality.
2. Fingerprint the software or firmware version and determine whether the target appears to be version 1.87.0 or earlier.
3. Send a crafted unauthenticated connectivity check request containing shell metacharacters or command separators in a user-controllable argument.
4. Execute a benign command first, such as a network callback, identity check, or file write, to confirm command execution.
5. Run reconnaissance commands to identify the operating system, privileges, network interfaces, credentials, configuration files, and reachable internal services.
6. Download and execute additional tooling or malware using built-in utilities such as curl, wget, sh, bash, nc, or busybox if present.
7. Establish persistence by modifying startup scripts, scheduled jobs, SSH configuration, local users, or application configuration.
8. Disrupt charger operation, manipulate configuration, exfiltrate data, or pivot to other systems reachable from the charging station network.

How to detect it

Investigate whether exploitation has already occurred by reviewing charging station application logs, embedded web server logs, reverse proxy logs, network firewall logs, DNS logs, EDR/process telemetry if available, Linux authentication logs, system logs, cron directories, startup scripts, and filesystem changes. Focus on requests to the connectivity check feature that contain shell metacharacters such as semicolons, pipes, backticks, command substitution, redirection, encoded newlines, or common command names. Correlate suspicious requests with new processes spawned by the web or management service, including sh, bash, ash, busybox, curl, wget, nc, netcat, telnet, python, perl, or openssl. Look for outbound connections from the charging station immediately after connectivity check activity, especially to unfamiliar external hosts or unusual ports. On the device, review /var/log/auth.log, /var/log/syslog, web/application logs, shell history, /tmp, /var/tmp, /dev/shm, cron locations, init/systemd locations, SSH authorized_keys files, and modified application configuration. Indicators of compromise may be environment-specific, so treat any command-like input submitted to the connectivity check feature as suspicious and investigate associated process, network, and file artifacts.

• connectivity check
• connectivity_check
• ;id
• ; id
• |id
• | id
• `id`
• $(id)
• %3Bid
• %7Cid
• %60id%60
• %24%28id%29
• ;uname -a
• |uname -a
• $(uname -a)
• ;cat /etc/passwd
• |cat /etc/passwd
• /etc/passwd
• ;wget
• |wget
• $(wget
• ;curl
• |curl
• $(curl
• ;busybox
• |busybox
• ;nc
• ;netcat
• /bin/sh -c
• /bin/bash -c
• /bin/ash -c
• /tmp/
• /var/tmp/
• /dev/shm/
• authorized_keys
• /etc/crontab
• /var/spool/cron
• /etc/cron.d/
• /etc/init.d/
• /etc/systemd/system/

What your security team should do

• Immediately inventory Hardy Barth cPH2 eCharge Ladestation deployments and identify systems running v1.87.0 or earlier.
• Prioritize remediation for any station management interface reachable from the internet, partner networks, public Wi-Fi, or other untrusted segments.
• Upgrade to the vendor-fixed firmware/software release; where Debian 11 package data applies, update to version 5.10.223-1 or later and reboot as required.
• Temporarily block unauthenticated access to the connectivity check functionality using firewall, reverse proxy, VPN, or management network controls until patching is complete.
• Hunt for exploitation attempts in web/application logs, device logs, shell/process telemetry, network egress logs, and file-system artifacts, especially because exploit code is weaponized and the EPSS probability is high.
• Look for unexpected outbound connections from charging stations to unknown IP addresses, especially HTTP, HTTPS, DNS, SSH, TCP reverse shells, or connections shortly after connectivity check requests.
• Check for unauthorized local users, SSH keys, cron jobs, modified startup scripts, unfamiliar binaries in temporary directories, and unexpected configuration changes.
• If compromise is suspected, isolate the device, preserve logs and volatile evidence where possible, rotate credentials and API keys associated with the station, reimage or factory reset from trusted media, and redeploy with fixed software.
• Add SIEM detections for shell metacharacters and command-execution utilities in connectivity check requests and for suspicious child processes spawned by the web or management service.
• Maintain network segmentation for operational technology and charging infrastructure so compromise of a station cannot easily reach business systems or other operational assets.