The server in Circontrol Raption through 5.11.2 has a pre-authentication stack-based buffer overflow that can be exploited to gain run-time control of the device as root. The ocpp1.5 and pwrstudio binaries on the charging station do not use a number of common exploitation mitigations. In particular, there are no stack canaries and they do not use the Position Independent Executable (PIE) format.
References
Configurations
No configuration.
History
21 Nov 2024, 05:38
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://circontrol.com/intelligent-charging-solutions/dc-chargers-series/raption-150/ - | |
| References | () https://seclists.org/fulldisclosure/2024/Mar/33 - |
01 Aug 2024, 13:42
| Type | Values Removed | Values Added |
|---|---|---|
| CWE | CWE-121 | |
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 8.8 |
12 Apr 2024, 12:43
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2024-04-12 12:15
Updated : 2024-11-21 05:38
NVD link : CVE-2020-8006
Mitre link : CVE-2020-8006
CVE.ORG link : CVE-2020-8006
JSON object : View
Products Affected
No product.
CWE
CWE-121
Stack-based Buffer Overflow