Advertisement






Circontrol Raption Buffer Overflow / Command Injection

CVE Category Price Severity
CVE-2020-8006 CWE-77 $5,000 High
Author Risk Exploitation Type Date
Unknown Critical Remote 2024-03-30
CPE
cpe:/a:circontrol:raption
Our sensors found this exploit at: https://cxsecurity.com/ascii/WLB-2024030078

Below is a copy:

Circontrol Raption Buffer Overflow / Command Injection
Circontrol EV Charger vulnerabilities.

1. CVE-2020-8006 Pre-Auth Stack Based Buffer Overflow
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H (10)

The server in Circontrol Raption through 5.11.2 has a pre-authentication
stack-based buffer overflow that can be exploited to gain run-time control
of the device as root.

When the server parses the HTTP headers and finds the Basic-Authentication
tag it will call a base64 decode function. This function takes 3 arguments:
an input pointer, an output pointer and a length. During the authentication
flow, the input pointer can be an attacker controlled string of
approximately 4096 characters, and the output pointer is located on the
stack, the length argument is 512. While the length of the stack based
buffer is passed to the decoder it only verifies that it is not smaller than
3.


[Vendor of Product]

https://circontrol.com/

[Affected Product Code Base]

Raption Server - Raption up to 5.11.2

[Affected Component]

OCCP 1.5, OCCP.1.6, PWRSTUDIO

[Attack Type]

Remote

[Impact Code execution]

true

[Impact Denial of Service]

true

[Attack Vectors]

Remote

[Has vendor confirmed or acknowledged the vulnerability?]

true

[Discoverer]

Abert Spruyt, Alex Salvetti, Dariusz Goda

[Reference]

https://circontrol.com/intelligent-charging-solutions/dc-chargers-series/raption-150/


2. CVE-2020-8007 - Command injection (RCE/authenticated)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L (9.1)

The pwrstudio web application of EV Charger (in the server in Circontrol
Raption through 5.6.2) is
vulnerable to OS command injection via three fields of the configuration
menu for ntpserver0, ntpserver1, and pingip.

[VulnerabilityType Other]

Command Injection

[Vendor of Product]

https://circontrol.com/

[Affected Product Code Base]

Raption Server - up to 5.6.2

[Affected Component]

pwrstudio

[Attack Type]

Remote

[Impact Code execution]

true

[Attack Vectors]

To exploit this issue authorization is required.


[Has vendor confirmed or acknowledged the vulnerability?]

true

[Discoverer]

Abert Spruyt, Alex Salvetti, Dariusz Goda


[Reference]

https://circontrol.com/intelligent-charging-solutions/dc-chargers-series/raption-150/

Copyright ©2024 Exploitalert.

All trademarks used are properties of their respective owners. By visiting this website you agree to Terms of Use.