CVE-2024-43663
Published: 09 January 2025
Summary
CVE-2024-43663 is a medium-severity Stack-based Buffer Overflow (CWE-121) vulnerability in Divd (inferred from references). Its CVSS base score is 5.3 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 9.2% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-16 (Memory Protection).
Deeper analysis
Multiple buffer overflow vulnerabilities exist in several CGI binaries that form part of the web interface on Iocharger AC model charging stations. The flaws affect firmware versions prior to 24120701 and are classified under CWE-121. They can be reached over the network and require only low-privileged authentication.
An authenticated attacker with network access to the web interface can supply crafted input to trigger the overflows. In most cases this produces a segmentation fault in the CGI process and a 502 response from the web server, yielding only limited availability impact. Skilled exploitation that bypasses ASLR to achieve remote code execution is considered possible but requires significant technical effort.
Public advisories from DIVD CSIRT describe the issues and identify the fixed firmware version 24120701 as the resolution. The associated references also note that the vulnerabilities were discovered through analysis of the charging station’s web server error behavior.
EPSS for the CVE has remained flat at 0.0594 with no material increase since disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-40407
Vulnerability details
There are many buffer overflow vulnerabilities present in several CGI binaries of the charging station.This issue affects Iocharger firmware for AC model chargers beforeversion 24120701. Likelihood: High – Given the prevalence of these buffer overflows, and the clear error message…
more
of the web server, an attacker is very likely to be able to find these vulnerabilities. Impact: Low – Usually, overflowing one of these buffers just causes a segmentation fault of the CGI binary, which causes the web server to return a 502 Bad Gateway error. However the webserver itself is not affected, and no DoS can be achieved. Abusing these buffer overflows in a meaningful way requires highly technical knowledge, especially since ASLR also seems to be enabled on the charging station. However, a skilled attacker might be able to use one of these buffer overflows to obtain remote code execution. CVSS clarification. The attack can be executed over any network connection the station is listening to and serves the web interface (AV:N), and there are no additional security measure sin place that need to be circumvented (AC:L), the attack does not rely on preconditions (AT:N). The attack does require authentication, but the level of authentication is irrelevant (PR:L), it does not require user interaction (UI:N). The attack has a small impact on the availability of the device (VC:N/VI:N/VA:L). There is no impact on subsequent systems. (SC:N/SI:N/SA:N). While this device is an EV charger handing significant amounts of power, we do not expect this vulnerability to have a safety impact. The attack can be automated (AU:Y).
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Buffer overflow in public-facing CGI web interface binaries directly enables remote code execution via T1190.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly addresses the inadequate bounds checking in CGI binaries that causes buffer overflows by requiring validation of malformed inputs.
Ensures timely remediation of known flaws like these buffer overflows through firmware updates to version 24120701 or later.
Implements memory protections such as ASLR and other safeguards to mitigate remote code execution from buffer overflow exploitation.