CVE-2024-43652
Published: 09 January 2025
Summary
CVE-2024-43652 is a critical-severity OS Command Injection (CWE-78) vulnerability in Divd (inferred from references). Its CVSS base score is 9.3 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked in the top 12.4% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2024-43652 is a command injection vulnerability (CWE-78) in Iocharger firmware for AC model chargers before version 24120701. The flaw permits OS command injection as root through improper neutralization of special elements, affecting a binary that is also shared with the vendor's Pedestal charging station.
An attacker with low-privilege access, or the ability to trick such a user into issuing a crafted HTTP request, can exploit the issue to obtain full root control of the charging station. This grants the ability to arbitrarily add, modify, or delete files and services on the device.
Public advisories from DIVD note that the issue is resolved in firmware 24120701 and direct users to the vendor for updated images, with further details at csirt.divd.nl/CVE-2024-43652 and csirt.divd.nl/DIVD-2024-00035.
The EPSS score rose from a low starting point to a peak of 0.0747 on 2025-12-11 before receding to 0.0336, indicating that exploitation interest emerged after disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-40396
Vulnerability details
Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability allows OS Command Injection as root This issue affects Iocharger firmware for AC model chargers before version 24120701 Likelihood: Moderate – The <redacted> binary does not seem to…
more
be used by the web interface, so it might be more difficult to find. It seems to be largely the same binary as used by the Iocharger Pedestal charging station, however. The attacker will also need a (low privilege) account to gain access to the <redacted> binary, or convince a user with such access to execute a crafted HTTP request. Impact: Critical – The attacker has full control over the charging station as the root user, and can arbitrarily add, modify and delete files and services.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Direct OS command injection (CWE-78) in exposed charger interface enables remote exploitation of public-facing app (T1190) to escalate from low-priv to root (T1068).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
SI-2 directly remediates the command injection flaw in the Iocharger firmware by requiring timely application of the vendor-provided update to version 24120701 or later.
SI-10 prevents OS command injection by enforcing validation of all information inputs to the affected binary, neutralizing special elements used in commands.
AC-6 least privilege mitigates the critical impact of root-level command injection by ensuring the vulnerable binary and associated accounts operate with minimal necessary privileges.