CVE-2025-3881
📋 TL;DR
This vulnerability allows network-adjacent attackers to execute arbitrary commands on eCharge Hardy Barth cPH2 charging stations without authentication. Attackers can inject malicious commands through the ntp parameter in the check_req.php endpoint, leading to remote code execution as the www-data user. Only installations of these specific charging stations are affected.
💻 Affected Systems
- eCharge Hardy Barth cPH2 charging station
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete compromise of charging station allowing attackers to disrupt charging operations, steal user data, manipulate billing, or pivot to other network devices.
Likely Case
Attackers execute arbitrary commands to disrupt charging operations, install backdoors, or use the device as a foothold for lateral movement.
If Mitigated
Limited impact due to network segmentation, but still potential for service disruption if exploited.
🎯 Exploit Status
Simple command injection via HTTP parameter manipulation. No authentication required.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Check vendor advisory for specific version
Vendor Advisory: https://www.zerodayinitiative.com/advisories/ZDI-25-247/
Restart Required: Yes
Instructions:
1. Contact eCharge Hardy Barth for patch information. 2. Apply vendor-provided firmware update. 3. Restart charging station. 4. Verify patch installation.
🔧 Temporary Workarounds
Network Segmentation
allIsolate charging stations from other network segments to limit attack surface
Access Control
linuxImplement firewall rules to restrict access to check_req.php endpoint
iptables -A INPUT -p tcp --dport 80 -m string --string "check_req.php" --algo bm -j DROP
🧯 If You Can't Patch
- Segment charging stations on isolated VLAN with no internet access
- Implement strict firewall rules blocking all unnecessary inbound traffic to charging stations
🔍 How to Verify
Check if Vulnerable:
Test if check_req.php endpoint accepts ntp parameter with command injection payloads (e.g., ntp=127.0.0.1;id)Check Version:
Check device web interface or contact vendor for firmware versionVerify Fix Applied:
Verify that command injection attempts no longer execute and return error messages📡 Detection & Monitoring
Log Indicators:
- Unusual command execution in system logs
- Multiple requests to check_req.php with suspicious ntp parameters
Network Indicators:
- HTTP POST requests to check_req.php containing shell metacharacters in ntp parameter
SIEM Query:
source="web_logs" AND uri="*check_req.php*" AND (param="*;*" OR param="*|*" OR param="*`*" OR param="*$(*")