CVE-2025-10371: eCharge Hardy Barth Salia PLCC RCE Flaw

CVE-2025-10371 Overview

CVE-2025-10371 is an unrestricted file upload vulnerability affecting eCharge Hardy Barth Salia PLCC electric vehicle charging controllers up to version 2.3.81. The flaw resides in the /api.php endpoint, where the setrfidlist argument fails to enforce restrictions on uploaded content. Remote attackers can exploit the issue over the network without authentication or user interaction. A public proof-of-concept exists, and the vendor did not respond to early disclosure attempts. The weakness is classified under CWE-284 (Improper Access Control).

Critical Impact
Remote attackers can upload arbitrary files to vulnerable Salia PLCC charging controllers without authentication, with a public exploit already released.

Affected Products

eCharge Hardy Barth Salia PLCC versions up to and including 2.3.81
The vulnerable endpoint is /api.php with the setrfidlist parameter
No vendor-supplied fixed version is documented at time of publication

Discovery Timeline

2025-09-13 - CVE-2025-10371 published to NVD
2026-04-29 - Last updated in NVD database

Technical Details for CVE-2025-10371

Vulnerability Analysis

The vulnerability stems from improper access control in the Salia PLCC web management interface. The /api.php script processes the setrfidlist parameter without validating the type, content, or destination of uploaded data. Attackers send crafted HTTP requests over the network and write files to the device file system.

Because the affected product is an EV charging controller, the application logic typically runs with elevated privileges on an embedded Linux platform. Arbitrary file write on such devices can enable web shell deployment, configuration tampering, or persistence on the charger. The vendor did not acknowledge the disclosure, leaving deployed units without an official patch.

Root Cause

The root cause is missing access control and missing input validation around the setrfidlist handler in /api.php. The endpoint accepts attacker-controlled data intended to manage RFID lists but does not verify the caller's authorization or constrain the upload to a safe location and file type. This maps directly to [CWE-284] Improper Access Control.

Attack Vector

The attack vector is network-based and requires no authentication or user interaction. An attacker with HTTP access to the charging controller sends a request to /api.php containing a manipulated setrfidlist value. The handler writes the supplied content to disk, producing an unrestricted upload condition. Public technical details and a proof of concept are available in the GitHub PoC Repository and tracked in VulDB #323779.

No verified exploitation code is reproduced here. Refer to the linked advisory for technical reproduction steps.

Detection Methods for CVE-2025-10371

Indicators of Compromise

Unexpected HTTP POST requests to /api.php containing the setrfidlist parameter from external or unmanaged source addresses
New or modified files in web-accessible directories on the Salia PLCC device that were not introduced by an administrator
Outbound network connections initiated by the charger to unknown hosts, suggesting deployed payloads

Detection Strategies

Inspect HTTP traffic to the charger management interface for requests targeting /api.php with setrfidlist parameters carrying script content or binary data
Baseline the device file system and alert on creation of files outside expected RFID list paths
Correlate authentication logs with administrative API calls to identify unauthenticated write operations

Monitoring Recommendations

Forward charger access logs and network flow data to a centralized SIEM for retention and analysis
Monitor management VLANs hosting EV charging infrastructure for HTTP requests originating outside operator subnets
Alert on repeated 200-status responses to /api.php from non-administrative source addresses

How to Mitigate CVE-2025-10371

Immediate Actions Required

Restrict network access to the Salia PLCC management interface so that only trusted operator hosts can reach /api.php
Place affected chargers behind a firewall or VPN and block direct internet exposure of the device web interface
Audit the device file system and web root for unexpected files and remove any unauthorized uploads

Patch Information

No vendor patch is referenced in the available CVE data. The disclosure notes that the vendor was contacted but did not respond. Operators should track the VulDB advisory for updates and contact eCharge Hardy Barth directly to request remediation guidance.

Workarounds

Segment EV charging infrastructure onto a dedicated network with strict ingress filtering toward TCP ports serving the web interface
Disable or proxy the /api.php endpoint at an upstream reverse proxy that enforces authentication and request validation
Apply web application firewall rules that drop requests to /api.php containing the setrfidlist parameter from unauthorized sources

bash

# Example iptables rule limiting access to the charger management interface
iptables -A INPUT -p tcp --dport 80 -s 10.10.20.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 80 -j DROP