CVE-2025-3881 Overview
CVE-2025-3881 is a command injection vulnerability in eCharge Hardy Barth cPH2 charging stations. The flaw exists in the check_req.php endpoint, which fails to validate the ntp parameter before passing it to a system call. Network-adjacent attackers can execute arbitrary code as the www-data user without authentication. The vulnerability was reported through the Zero Day Initiative as ZDI-CAN-23113 and tracked by the advisory ZDI-25-247. It maps to [CWE-78] (OS Command Injection) and affects Hardy Barth cPH2 firmware version 2.0.4.
Critical Impact
Unauthenticated network-adjacent attackers can execute arbitrary commands on affected charging stations and gain control of the device.
Affected Products
- Hardy Barth cPH2 eCharge firmware version 2.0.4
- Hardy Barth cPH2 eCharge charging station hardware
- Deployments exposing the check_req.php endpoint on adjacent networks
Discovery Timeline
- 2025-05-22 - CVE-2025-3881 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-3881
Vulnerability Analysis
The vulnerability resides in the check_req.php endpoint of the cPH2 charging station web interface. The endpoint accepts an ntp parameter from HTTP requests and incorporates the value into a shell command without sanitization. An attacker on an adjacent network can append shell metacharacters to the parameter to inject arbitrary operating system commands. Successful exploitation runs commands as the www-data user, the account that owns the embedded web server process.
The issue is classified under [CWE-78] (Improper Neutralization of Special Elements used in an OS Command). The EPSS model assigns the CVE a probability near 0.79 percent, reflecting limited public exploitation reporting at the time of disclosure.
Root Cause
The root cause is missing input validation on the ntp parameter. The PHP handler builds a shell command string using the parameter value and passes it to a system execution function. Because no allow-list, escaping, or argument separation is applied, characters such as ;, |, backticks, and $() terminate the intended command and start a new one.
Attack Vector
The attack vector requires adjacency to the charging station network segment. No credentials are required. An attacker sends a crafted HTTP request to check_req.php with a malicious ntp value. The injected payload runs in the context of the web server user, providing read and write access to the device file system, network interfaces, and any local services. From this foothold the attacker can pivot to firmware modification, denial of charging service, or lateral movement within the operational technology network.
No verified proof-of-concept code is published. The Zero Day Initiative Advisory ZDI-25-247 describes the parameter handling defect in additional detail.
Detection Methods for CVE-2025-3881
Indicators of Compromise
- HTTP requests to /check_req.php containing shell metacharacters such as ;, |, backticks, or $( in the ntp parameter
- Unexpected outbound connections initiated by the www-data process on the charging station
- New or modified files in web-writable directories on the cPH2 device
- NTP configuration entries that contain command fragments rather than valid hostnames
Detection Strategies
- Inspect web server access logs for check_req.php requests with non-alphanumeric characters in the ntp query parameter.
- Deploy network IDS signatures that flag command-injection patterns targeting charging station HTTP endpoints.
- Baseline expected process activity on the device and alert on shell processes spawned by the PHP interpreter.
Monitoring Recommendations
- Forward charging station logs and adjacent network telemetry to a centralized analytics platform such as Singularity Data Lake for correlation and retention.
- Monitor for anomalous DNS queries and outbound traffic originating from electric vehicle supply equipment segments.
- Track configuration changes to NTP and other system services that take user-controlled input.
How to Mitigate CVE-2025-3881
Immediate Actions Required
- Restrict network access to cPH2 management interfaces using firewall rules or VLAN segmentation.
- Block external and untrusted access to check_req.php at the perimeter or local switch.
- Audit existing devices for signs of prior exploitation, including modified web files and unexpected cron entries.
- Contact Hardy Barth support to confirm the availability of a firmware update addressing the ntp parameter handling.
Patch Information
No vendor patch URL is referenced in the NVD entry at this time. Operators should consult Hardy Barth directly and monitor the Zero Day Initiative Advisory ZDI-25-247 for updates on remediation.
Workarounds
- Place cPH2 charging stations on an isolated management network with no direct access from corporate or guest Wi-Fi segments.
- Require VPN or jump-host access for any administrative interaction with the device web interface.
- Disable or firewall the check_req.php endpoint where the device deployment allows custom web server rules.
- Apply strict egress filtering on the charging station segment to limit command-and-control opportunities if exploitation occurs.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
