https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2025-25271.htmlhttps://patchthecve.com/cve/CVE-2025-25271.htmlWed, 17 Jun 2026 09:00:35 +0000HIGH 8.8: An unauthenticated adjacent attacker is able to configure a new OCPP backend, due to insecure defaults for the configuration interface.https://patchthecve.com/cve/CVE-2025-25270.htmlhttps://patchthecve.com/cve/CVE-2025-25270.htmlWed, 17 Jun 2026 09:00:35 +0000CRITICAL 9.8: An unauthenticated remote attacker can alter the device configuration in a way to get remote code execution as root with specific configurations.https://patchthecve.com/cve/CVE-2025-25269.htmlhttps://patchthecve.com/cve/CVE-2025-25269.htmlWed, 17 Jun 2026 09:00:35 +0000HIGH 8.4: An unauthenticated local attacker can inject a command that is subsequently executed as root, leading to a privilege escalation.https://patchthecve.com/cve/CVE-2025-25268.htmlhttps://patchthecve.com/cve/CVE-2025-25268.htmlWed, 17 Jun 2026 09:00:35 +0000HIGH 8.8: An unauthenticated adjacent attacker can modify configuration by sending specific requests to an API-endpoint resulting in read and write access due to missing authentication.https://patchthecve.com/cve/CVE-2025-24006.htmlhttps://patchthecve.com/cve/CVE-2025-24006.htmlWed, 17 Jun 2026 08:57:52 +0000HIGH 7.8: A low privileged local attacker can leverage insecure permissions via SSH on the affected devices to escalate privileges to root.https://patchthecve.com/cve/CVE-2025-24005.htmlhttps://patchthecve.com/cve/CVE-2025-24005.htmlWed, 17 Jun 2026 08:57:52 +0000HIGH 7.8: A local attacker with a local user account can leverage a vulnerable script via SSH to escalate privileges to root due to improper input validation.https://patchthecve.com/cve/CVE-2025-24004.htmlhttps://patchthecve.com/cve/CVE-2025-24004.htmlWed, 17 Jun 2026 08:57:52 +0000MEDIUM 5.2: A physical attacker with access to the device display via USB-C can send a message to the device which triggers an unsecure copy to a buffer resulting in loss of integrity and a temporary denial-of-service for the stations until they got restarted by the watchdog.https://patchthecve.com/cve/CVE-2025-24003.htmlhttps://patchthecve.com/cve/CVE-2025-24003.htmlWed, 17 Jun 2026 08:57:52 +0000HIGH 8.2: An unauthenticated remote attacker can use MQTT messages to trigger out-of-bounds writes in charging stations complying with German Calibration Law, resulting in a loss of integrity for only EichrechtAgents and potential denial-of-service for these stations.https://patchthecve.com/cve/CVE-2025-24002.htmlhttps://patchthecve.com/cve/CVE-2025-24002.htmlWed, 17 Jun 2026 08:57:52 +0000MEDIUM 5.3: An unauthenticated remote attacker can use MQTT messages to crash a service on charging stations complying with German Calibration Law, resulting in a temporary denial-of-service for these stations until they got restarted by the watchdog.https://patchthecve.com/cve/CVE-2024-6788.htmlhttps://patchthecve.com/cve/CVE-2024-6788.htmlWed, 17 Jun 2026 08:18:42 +0000HIGH 8.6: A remote unauthenticated attacker can use the firmware update feature on the LAN interface of the device to reset the password for the predefined, low-privileged user “user-app” to the default password.https://patchthecve.com/cve/CVE-2024-3913.htmlhttps://patchthecve.com/cve/CVE-2024-3913.htmlWed, 17 Jun 2026 07:45:27 +0000MEDIUM 5.9: An unauthenticated remote attacker can use this vulnerability to change the device configuration due to a file writeable for short time after system startup.https://patchthecve.com/cve/CVE-2024-28137.htmlhttps://patchthecve.com/cve/CVE-2024-28137.htmlWed, 17 Jun 2026 07:21:02 +0000HIGH 7.8: A local attacker with low privileges can perform a privilege escalation with an init script due to a TOCTOU vulnerability. https://patchthecve.com/cve/CVE-2024-28136.htmlhttps://patchthecve.com/cve/CVE-2024-28136.htmlWed, 17 Jun 2026 07:21:02 +0000HIGH 7.8: A local attacker with low privileges can use a command injection vulnerability to gain root privileges due to improper input validation using the OCPP Remote service.https://patchthecve.com/cve/CVE-2024-28135.htmlhttps://patchthecve.com/cve/CVE-2024-28135.htmlWed, 17 Jun 2026 07:21:02 +0000MEDIUM 5.0: A low privileged remote attacker can use a command injection vulnerability in the API which performs remote code execution as the user-app user due to improper input validation. The confidentiality is partly affected.https://patchthecve.com/cve/CVE-2024-28134.htmlhttps://patchthecve.com/cve/CVE-2024-28134.htmlWed, 17 Jun 2026 07:21:01 +0000HIGH 7.0: An unauthenticated remote attacker can extract a session token with a MitM attack and gain web-based management access with the privileges of the currently logged in user due to cleartext transmission of sensitive information. No additiohttps://patchthecve.com/cve/CVE-2024-28133.htmlhttps://patchthecve.com/cve/CVE-2024-28133.htmlWed, 17 Jun 2026 07:21:01 +0000HIGH 7.8: A local low privileged attacker can use an untrusted search path in a CHARX system utility to gain root privileges.  https://patchthecve.com/cve/CVE-2024-26288.htmlhttps://patchthecve.com/cve/CVE-2024-26288.htmlWed, 17 Jun 2026 07:17:32 +0000HIGH 8.7: An unauthenticated remote attacker can influence the communication due to the lack of encryption of sensitive data via a MITM. Charging is not affected.https://patchthecve.com/cve/CVE-2024-26005.htmlhttps://patchthecve.com/cve/CVE-2024-26005.htmlWed, 17 Jun 2026 07:16:54 +0000MEDIUM 4.8: An unauthenticated remote attacker can gain service level privileges through an incomplete cleanup during service restart after a DoS. https://patchthecve.com/cve/CVE-2024-26004.htmlhttps://patchthecve.com/cve/CVE-2024-26004.htmlWed, 17 Jun 2026 07:16:54 +0000HIGH 7.5: An unauthenticated remote attacker can DoS a control agent due to access of a uninitialized pointer which may prevent or disrupt the charging functionality. https://patchthecve.com/cve/CVE-2024-26003.htmlhttps://patchthecve.com/cve/CVE-2024-26003.htmlWed, 17 Jun 2026 07:16:54 +0000HIGH 7.5: An unauthenticated remote attacker can DoS the control agent due to a out-of-bounds read which may prevent or disrupt the charging functionality. https://patchthecve.com/cve/CVE-2024-26002.htmlhttps://patchthecve.com/cve/CVE-2024-26002.htmlWed, 17 Jun 2026 07:16:53 +0000HIGH 7.8: An improper input validation in the Qualcom plctool allows a local attacker with low privileges to gain root access by changing the ownership of specific files.https://patchthecve.com/cve/CVE-2024-26001.htmlhttps://patchthecve.com/cve/CVE-2024-26001.htmlWed, 17 Jun 2026 07:16:53 +0000HIGH 7.4: An unauthenticated remote attacker can write memory out of bounds due to improper input validation in the MQTT stack. The brute force attack is not always successful because of memory randomization.https://patchthecve.com/cve/CVE-2024-26000.htmlhttps://patchthecve.com/cve/CVE-2024-26000.htmlWed, 17 Jun 2026 07:16:53 +0000MEDIUM 5.9: An unauthenticated remote attacker can read memory out of bounds due to improper input validation in the MQTT stack. The brute force attack is not always successful because of memory randomization.https://patchthecve.com/cve/CVE-2024-25999.htmlhttps://patchthecve.com/cve/CVE-2024-25999.htmlWed, 17 Jun 2026 07:16:53 +0000HIGH 8.4: An unauthenticated local attacker can perform a privilege escalation due to improper input validation in the OCPP agent service. https://patchthecve.com/cve/CVE-2024-25998.htmlhttps://patchthecve.com/cve/CVE-2024-25998.htmlWed, 17 Jun 2026 07:16:53 +0000HIGH 7.3: An unauthenticated remote attacker can perform a command injection in the OCPP Service with limited privileges due to improper input validation.https://patchthecve.com/cve/CVE-2024-25997.htmlhttps://patchthecve.com/cve/CVE-2024-25997.htmlWed, 17 Jun 2026 07:16:53 +0000MEDIUM 5.3: An unauthenticated remote attacker can perform a log injection due to improper input validation. Only a certain log file is affected. https://patchthecve.com/cve/CVE-2024-25996.htmlhttps://patchthecve.com/cve/CVE-2024-25996.htmlWed, 17 Jun 2026 07:16:53 +0000MEDIUM 5.3: An unauthenticated remote attacker can perform a remote code execution due to an origin validation error. The access is limited to the service user.https://patchthecve.com/cve/CVE-2024-25995.htmlhttps://patchthecve.com/cve/CVE-2024-25995.htmlWed, 17 Jun 2026 07:16:52 +0000CRITICAL 9.8: An unauthenticated remote attacker can modify configurations to perform a remote code execution, gain root rights or perform an DoS due to improper input validation.https://patchthecve.com/cve/CVE-2024-25994.htmlhttps://patchthecve.com/cve/CVE-2024-25994.htmlWed, 17 Jun 2026 07:16:52 +0000MEDIUM 5.3: An unauthenticated remote attacker can upload a arbitrary script file due to improper input validation. The upload destination is fixed and is write only.