VulnerabilityAnalyzed

CVE-2024-44843

An issue in the web socket handshake process of SteVe v3.7.1 allows attackers to bypass authentication and execute arbitrary coammands via supplying crafted OCPP requests.

MEDIUM 5.9EPSS 0.44%

Does this matter?

Lower severity and a low EPSS score (0.44%). Track it; it rarely justifies an emergency change on its own.

Description

An issue in the web socket handshake process of SteVe v3.7.1 allows attackers to bypass authentication and execute arbitrary coammands via supplying crafted OCPP requests.

CVSS 3.1: 5.9 MEDIUMCVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:L/A:L
EPSS: 0.44% probability · 37th percentile
CISA KEV: Not listed
Weakness: CWE-287
Affected: steve-community/steve
Source: cve@mitre.org

References

https://gist.github.com/Badranh/94359664799db6d4709871f0c353f476Exploit, Third Party Advisory
https://github.com/steve-community/steve/blob/master/src/main/java/de/rwth/idsg/steve/ocpp/ws/OcppWebSocketHandshakeHandler.javaProduct
https://github.com/steve-community/steve/issues/1546Issue Tracking

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.