Horizon Alert
Summary of the vulnerability and why it matters
This CVE involves a critical vulnerability in certain electric vehicle charging stations that allows an unauthenticated remote attacker to bypass authentication and change user passwords. The main concern is confirming relevance and exposure for these internet-connected devices.
- Unauthenticated attackers can change charging station passwords.
- These are internet-connected devices, making them potentially accessible.
- Assess exposure to ensure operational security.
Attack Path
How an attacker could exploit the issue
An attacker with network access can target the web interface of the Mennekes Amtron charging station. By sending a specially crafted request to a specific endpoint, an unauthenticated attacker can bypass authentication and change the administrator password, gaining control over the device.
- Requires network access.
- Triggers via crafted POST request.
- Leads to unauthorized administrative control.
Live Threat
Current exploitation, exposure, and threat context
This vulnerability could allow an unauthenticated remote attacker to bypass authentication and change the password for the operator account on the affected charging station system. This could potentially disrupt legitimate operator access and control over the charging station's functions.
- Operator account credentials.
- Crafted POST request to `/operator/operator` endpoint.
- Disruption of legitimate operator access.
Operational Fix
Recommended remediation, mitigation, and detection steps
The Mennekes Amtron series, used for electric vehicle charging, presents a critical risk due to an authentication bypass vulnerability. This could allow unauthenticated remote attackers to reset user passwords. Ownership likely falls to the infrastructure or platform teams managing the charging stations, with initial steps involving asset discovery, confirming network reachability and business criticality, and identifying the accountable owner before planning remediation.
- Identify and confirm affected assets.
- Verify network exposure and criticality.
- Plan remediation with asset owners.
