CVE-2021-45876

2022-03-2110:27:40

mitre

www.cve.org

garo wallbox

unauthenticated command injection

firmware

AI Score

Confidence

High

EPSS

0.001

Percentile

44.7%

JSON

Multiple versions of GARO Wallbox GLB/GTB/GTC are affected by unauthenticated command injection. The url parameter of the function module downloadAndUpdate is vulnerable to an command Injection. Unfiltered user input is used to generate code which then gets executed when downloading new firmware.

References

github.com/delikely/advisory/tree/main/GARO