CVE-2025-22368

The authenticated SCU firmware command of the firmware for Mennekes Smart / Premium Chargingpoints can be abused for command execution because OS commands are improperly neutralized when certain fields are passed to the underlying OS.

CVSS

No CVSS.

References

Link	Resource
https://csirt.divd.nl/CVE-2025-22368
https://csirt.divd.nl/DIVD-2025-00003
https://www.mennekes.nl/fileadmin/MEN-Deutschland/emobility/04_software/06_smart_premium/Release_Notes_for_2.15_06.03.2025.pdf

Configurations

No configuration.

History

15 Apr 2026, 00:35

Type	Values Removed	Values Added
Summary		(es) El comando de firmware SCU autenticado del firmware para Mennekes Smart / Premium Chargingpoints se puede utilizar de forma indebida para la ejecución de comandos porque los comandos del SO se neutralizan incorrectamente cuando ciertos campos se pasan al SO subyacente.

11 Mar 2025, 14:15

Type	Values Removed	Values Added
New CVE

Information

Published : 2025-03-11 14:15

Updated : 2026-04-15 00:35

NVD link : CVE-2025-22368

Mitre link : CVE-2025-22368

CVE.ORG link : CVE-2025-22368

JSON object : View

Products Affected

No product.

CWE

CWE-78

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

CWE-250

Execution with Unnecessary Privileges

{"id": "CVE-2025-22368", "cveTags": [], "metrics": {"cvssMetricV40": [{"type": "Secondary", "source": "csirt@divd.nl", "cvssData": {"Safety": "NEGLIGIBLE", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 8.7, "Automatable": "YES", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:N/AU:Y/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "LOW", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "published": "2025-03-11T14:15:24.627", "references": [{"url": "https://csirt.divd.nl/CVE-2025-22368", "source": "csirt@divd.nl"}, {"url": "https://csirt.divd.nl/DIVD-2025-00003", "source": "csirt@divd.nl"}, {"url": "https://www.mennekes.nl/fileadmin/MEN-Deutschland/emobility/04_software/06_smart_premium/Release_Notes_for_2.15_06.03.2025.pdf", "source": "csirt@divd.nl"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "csirt@divd.nl", "description": [{"lang": "en", "value": "CWE-78"}, {"lang": "en", "value": "CWE-250"}]}], "descriptions": [{"lang": "en", "value": "The authenticated SCU firmware command of the firmware for Mennekes Smart / Premium Chargingpoints can be abused for command execution because OS commands are improperly neutralized when certain fields are passed to the underlying OS."}, {"lang": "es", "value": "El comando de firmware SCU autenticado del firmware para Mennekes Smart / Premium Chargingpoints se puede utilizar de forma indebida para la ejecuci\u00f3n de comandos porque los comandos del SO se neutralizan incorrectamente cuando ciertos campos se pasan al SO subyacente."}], "lastModified": "2026-04-15T00:35:42.020", "sourceIdentifier": "csirt@divd.nl"}