External risk intelligence

Hardy Barth cPH2 eCharge Command Injection Vulnerability.

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2023-46359

The device is an internet-connected electric vehicle charging station. These devices are frequently managed via web interfaces or APIs exposed to the network to facilitate remote monitoring, billing, and connectivity, making the command injection vulnerability in its connectivity check feature likely to be reachable from the internet in common deployments.

OS Command Injection

Hardy Barth Cph2 Echarge Firmware

1.87.0 and earlier

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

An OS command injection vulnerability has been identified in certain Hardy Barth cPH2 eCharge charging stations, potentially allowing unauthorized individuals to execute commands on the system. This issue affects the connectivity check feature and could be exploited by remote attackers without requiring authentication, raising concerns about system compromise.

Attackers can run any command on affected devices.
External access to critical infrastructure is a significant risk.
Confirm relevance and exposure to charging station systems.

Attack Path

How an attacker could exploit the issue

An unauthenticated attacker can exploit this vulnerability by sending specially crafted data to the charging station's connectivity check feature. This feature, when improperly handling input, allows an attacker to inject and execute arbitrary operating system commands remotely. Successful exploitation could grant the attacker control over the affected system.

No authentication required.
Triggered via crafted connectivity check arguments.
Risk of arbitrary command execution.

Live Threat

Current exploitation, exposure, and threat context

An unauthenticated remote attacker could execute arbitrary commands on the system by sending specially crafted arguments to the connectivity check feature. This could potentially impact the operating system and its services when the device is accessible over a network.

System commands could be executed.
Via specially crafted connectivity check arguments.
Service disruption or unauthorized access.

Operational Fix

Recommended remediation, mitigation, and detection steps

This critical vulnerability, affecting the Hardy Barth cPH2 eCharge Ladestation, likely impacts organizations with connected charging infrastructure. The first practical step is to identify all instances of this technology, determine their network exposure and business criticality, and locate the accountable owner. Remediation planning should then be risk-based, potentially involving coordination with the vendor.

Infrastructure and security teams should own the issue.
Verify network exposure and critical assets.
Plan vendor-coordinated remediation.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Hardy Barth cPH2 eCharge device?

The Hardy Barth cPH2 eCharge is an electric vehicle charging station. These devices are designed to manage charging sessions and often feature integrated web interfaces or APIs that allow users and operators to monitor energy consumption, handle billing, and manage network connectivity for the charging hardware.

What does OS command injection mean for CVE-2023-46359?

This vulnerability, classified as CWE-78, occurs when a program fails to properly filter user input before passing it to the system's command shell. In this case, the device's connectivity check feature allows an attacker to inject and execute their own unauthorized operating system commands directly on the charging station, essentially giving them the ability to run whatever instructions they choose on the hardware.

How is CVE-2023-46359 triggered?

An attacker triggers this issue by sending specifically crafted arguments to the connectivity check function found on the device. Because the feature does not properly validate the data it receives, the system interprets the attacker's input as a command to be executed. Merely accessing the device's web page or network presence without sending these malicious arguments to the connectivity check feature does not trigger the vulnerability.

Is my device vulnerable to CVE-2023-46359?

According to Halo Surface Signal, these charging stations are often placed on networks to facilitate remote monitoring and management, which frequently exposes their interfaces to the internet. If your cPH2 eCharge unit is accessible via the public internet, it is at higher risk of being reachable by remote attackers. You should consider any device running firmware version 1.87.0 or earlier to be potentially affected.

What should I do if I run Hardy Barth charging stations?

Start by performing an inventory to locate all deployed cPH2 eCharge units within your network environment. Once identified, assess their connectivity to determine if they are exposed to the internet. Identify the team or individual responsible for these systems and coordinate with the vendor to determine the availability of firmware updates or guidance on securing the affected connectivity features.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.