CVE-2025-25271

< 1.7.3

An unauthenticated adjacent attacker is able to configure a new OCPP backend, due to insecure defaults for the configuration inter

8.8HIGH

CVE-2025-25270

< 1.7.3

An unauthenticated remote attacker can alter the device configuration in a way to get remote code execution as root with specific

9.8CRITICAL

CVE-2025-25269

< 1.7.3

An unauthenticated local attacker can inject a command that is subsequently executed as root, leading to a privilege escalation.

8.4HIGH

CVE-2025-25268

< 1.7.3

An unauthenticated adjacent attacker can modify configuration by sending specific requests to an API-endpoint resulting in read an

8.8HIGH

CVE-2025-24006

< 1.7.3

A low privileged local attacker can leverage insecure permissions via SSH on the affected devices to escalate privileges to root.

7.8HIGH

CVE-2025-24005

< 1.7.3

A local attacker with a local user account can leverage a vulnerable script via SSH to escalate privileges to root due to improper

7.8HIGH

CVE-2025-24004

<= 1.6.5

A physical attacker with access to the device display via USB-C can send a message to the device which triggers an unsecure copy t

5.2MEDIUM

CVE-2025-24003

<= 1.6.5

An unauthenticated remote attacker can use MQTT messages to trigger out-of-bounds writes in charging stations complying with Germa

8.2HIGH

CVE-2025-24002

<= 1.6.5

An unauthenticated remote attacker can use MQTT messages to crash a service on charging stations complying with German Calibration

5.3MEDIUM

CVE-2024-6788

< 1.6.3

A remote unauthenticated attacker can use the firmware update feature on the LAN interface of the device to reset the password for

8.6HIGH

CVE-2024-3913

< 1.6.3

An unauthenticated remote attacker can use this vulnerability to change the device configuration due to a file writeable for short

5.9MEDIUM

CVE-2024-28137

<= 1.5.1

A local attacker with low privileges can perform a privilege escalation with an init script due to a TOCTOU vulnerability.

7.8HIGH

CVE-2024-28136

<= 1.5.1

A local attacker with low privileges can use a command injection vulnerability to gain root privileges due to improper input valid

7.8HIGH

CVE-2024-28135

<= 1.5.1

A low privileged remote attacker can use a command injection vulnerability in the API which performs remote code execution as the

5.0MEDIUM

CVE-2024-28134

<= 1.5.1

An unauthenticated remote attacker can extract a session token with a MitM attack and gain web-based management access with the p

7.0HIGH

CVE-2024-28133

<= 1.5.1

A local low privileged attacker can use an untrusted search path in a CHARX system utility to gain root privileges.

7.8HIGH

CVE-2024-26288

< 1.5.1

An unauthenticated remote attacker can influence the communication due to the lack of encryption of sensitive data via a MITM. Cha

8.7HIGH

CVE-2024-26005

< 1.5.1

An unauthenticated remote attacker can gain service level privileges through an incomplete cleanup during service restart after a

4.8MEDIUM

CVE-2024-26004

< 1.5.1

An unauthenticated remote attacker can DoS a control agent due to access of a uninitialized pointer which may prevent or disrupt

7.5HIGH

CVE-2024-26003

< 1.5.1

An unauthenticated remote attacker can DoS the control agent due to a out-of-bounds read which may prevent or disrupt the charging

7.5HIGH

CVE-2024-26002

< 1.5.1

An improper input validation in the Qualcom plctool allows a local attacker with low privileges to gain root access by changing th

7.8HIGH

CVE-2024-26001

< 1.5.1

An unauthenticated remote attacker can write memory out of bounds due to improper input validation in the MQTT stack. The brute f

7.4HIGH

CVE-2024-26000

< 1.5.1

An unauthenticated remote attacker can read memory out of bounds due to improper input validation in the MQTT stack. The brute fo

5.9MEDIUM

CVE-2024-25999

< 1.5.1

An unauthenticated local attacker can perform a privilege escalation due to improper input validation in the OCPP agent service.

8.4HIGH

CVE-2024-25998

< 1.5.1

An unauthenticated remote attacker can perform a command injection in the OCPP Service with limited privileges due to improper i

7.3HIGH

CVE-2024-25997

< 1.5.1

An unauthenticated remote attacker can perform a log injection due to improper input validation. Only a certain log file is affect

5.3MEDIUM

CVE-2024-25996

< 1.5.1

An unauthenticated remote attacker can perform a remote code execution due to an origin validation error. The access is limited to

5.3MEDIUM

CVE-2024-25995

< 1.5.1

An unauthenticated remote attacker can modify configurations to perform a remote code execution, gain root rights or perform an Do

9.8CRITICAL

CVE-2024-25994

< 1.5.1

An unauthenticated remote attacker can upload a arbitrary script file due to improper input validation. The upload destination is

5.3MEDIUM