https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2025-25271.htmlhttps://patchthecve.com/cve/CVE-2025-25271.htmlWed, 17 Jun 2026 09:00:35 +0000HIGH 8.8: An unauthenticated adjacent attacker is able to configure a new OCPP backend, due to insecure defaults for the configuration interface.https://patchthecve.com/cve/CVE-2025-25270.htmlhttps://patchthecve.com/cve/CVE-2025-25270.htmlWed, 17 Jun 2026 09:00:35 +0000CRITICAL 9.8: An unauthenticated remote attacker can alter the device configuration in a way to get remote code execution as root with specific configurations.https://patchthecve.com/cve/CVE-2025-25269.htmlhttps://patchthecve.com/cve/CVE-2025-25269.htmlWed, 17 Jun 2026 09:00:35 +0000HIGH 8.4: An unauthenticated local attacker can inject a command that is subsequently executed as root, leading to a privilege escalation.https://patchthecve.com/cve/CVE-2025-25268.htmlhttps://patchthecve.com/cve/CVE-2025-25268.htmlWed, 17 Jun 2026 09:00:35 +0000HIGH 8.8: An unauthenticated adjacent attacker can modify configuration by sending specific requests to an API-endpoint resulting in read and write access due to missing authentication.https://patchthecve.com/cve/CVE-2025-24006.htmlhttps://patchthecve.com/cve/CVE-2025-24006.htmlWed, 17 Jun 2026 08:57:52 +0000HIGH 7.8: A low privileged local attacker can leverage insecure permissions via SSH on the affected devices to escalate privileges to root.https://patchthecve.com/cve/CVE-2025-24005.htmlhttps://patchthecve.com/cve/CVE-2025-24005.htmlWed, 17 Jun 2026 08:57:52 +0000HIGH 7.8: A local attacker with a local user account can leverage a vulnerable script via SSH to escalate privileges to root due to improper input validation.https://patchthecve.com/cve/CVE-2025-24004.htmlhttps://patchthecve.com/cve/CVE-2025-24004.htmlWed, 17 Jun 2026 08:57:52 +0000MEDIUM 5.2: A physical attacker with access to the device display via USB-C can send a message to the device which triggers an unsecure copy to a buffer resulting in loss of integrity and a temporary denial-of-service for the stations until they got restarted by the watchdog.https://patchthecve.com/cve/CVE-2025-24003.htmlhttps://patchthecve.com/cve/CVE-2025-24003.htmlWed, 17 Jun 2026 08:57:52 +0000HIGH 8.2: An unauthenticated remote attacker can use MQTT messages to trigger out-of-bounds writes in charging stations complying with German Calibration Law, resulting in a loss of integrity for only EichrechtAgents and potential denial-of-service for these stations.https://patchthecve.com/cve/CVE-2025-24002.htmlhttps://patchthecve.com/cve/CVE-2025-24002.htmlWed, 17 Jun 2026 08:57:52 +0000MEDIUM 5.3: An unauthenticated remote attacker can use MQTT messages to crash a service on charging stations complying with German Calibration Law, resulting in a temporary denial-of-service for these stations until they got restarted by the watchdog.https://patchthecve.com/cve/CVE-2024-6788.htmlhttps://patchthecve.com/cve/CVE-2024-6788.htmlWed, 17 Jun 2026 08:18:42 +0000HIGH 8.6: A remote unauthenticated attacker can use the firmware update feature on the LAN interface of the device to reset the password for the predefined, low-privileged user “user-app” to the default password.https://patchthecve.com/cve/CVE-2024-3913.htmlhttps://patchthecve.com/cve/CVE-2024-3913.htmlWed, 17 Jun 2026 07:45:27 +0000MEDIUM 5.9: An unauthenticated remote attacker can use this vulnerability to change the device configuration due to a file writeable for short time after system startup.