Paper/Archive/CVE-2020-8007

CVE-2020-8007

pwrstudio ev_charger — The pwrstudio web application of EV Charger (in the server in Circontrol Raption through 5.6.2) is vulnerable to OS command injection via…

EPSS 2%CVSS 9.8

critical.is priorityof 100

CVSS 9.8 (ADP)9.8 / 10 × 3029.4 Not in CISA KEV+300.0 EPSS percentile 77.8.778 × 2015.6 No public exploit+100.0 SSVC exploitation: none+100.0

Description · from the CVE record

The pwrstudio web application of EV Charger (in the server in Circontrol Raption through 5.6.2) is vulnerable to OS command injection via three fields of the configuration menu for ntpserver0, ntpserver1, and pingip.

Affected

ProductAffectedFixed inSource

n/an/a–CNA

ev_charger≤ 5.6.2–CISA-ADP

Scores by source

CISA ADP9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

refcircontrol.com/intelligent-charging-solutions/dc-chargers-series/raption-150 refseclists.org/fulldisclosure/2024/Mar/33 refseclists.org/fulldisclosure/2024/Mar/33