CVE-2025-3883 Overview
CVE-2025-3883 is a command injection vulnerability affecting eCharge Hardy Barth cPH2 charging stations. The flaw resides in the index.php endpoint, where GET parameters are passed to a system call without proper validation. Network-adjacent attackers can exploit this issue without authentication to execute arbitrary commands in the context of the www-data user. The vulnerability was reported through the Zero Day Initiative as ZDI-CAN-23115 and tracked under advisory ZDI-25-249. Successful exploitation grants attackers control over the charging station's underlying operating system. This affects firmware version 2.0.4 of the cPH2 eCharge device.
Critical Impact
Unauthenticated adjacent-network attackers can achieve remote code execution on cPH2 charging stations as the www-data user, compromising device integrity and confidentiality.
Affected Products
- Hardy-barth cPH2 eCharge Firmware version 2.0.4
- Hardy-barth cPH2 eCharge hardware device
- Deployments exposing the cPH2 web interface on local network segments
Discovery Timeline
- 2025-05-22 - CVE-2025-3883 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-3883
Vulnerability Analysis
The vulnerability is classified as an OS Command Injection issue [CWE-78]. The index.php script in the cPH2 web interface accepts GET parameters and incorporates them into a shell command without sanitizing the input. An attacker who can reach the charging station's HTTP service can inject shell metacharacters into a vulnerable parameter and have the underlying OS execute injected commands.
Exploitation does not require authentication. The attacker must have network adjacency, meaning the attacker is on the same logical network segment as the device. Charging stations frequently sit on operator LANs, building networks, or shared infrastructure where adjacency is achievable. Code executes as the www-data user, providing a foothold to pivot, modify firmware behavior, or disrupt charging operations.
Root Cause
The root cause is missing input validation and unsafe construction of a system call. User-supplied GET parameter data flows into a shell invocation without escaping or allowlisting. Shell metacharacters such as ;, |, &, and backticks are interpreted by the shell rather than treated as literal data, allowing arbitrary command execution.
Attack Vector
An attacker sends a crafted HTTP GET request to the index.php endpoint on the cPH2 device. The request includes a parameter containing shell metacharacters and the attacker's payload. The web application invokes a system command that concatenates the attacker-controlled string, and the shell executes the injected commands. Refer to the ZDI-25-249 advisory for technical specifics on the vulnerable parameter.
Detection Methods for CVE-2025-3883
Indicators of Compromise
- Unexpected outbound network connections originating from the cPH2 device
- Presence of new files, scripts, or cron entries created by the www-data user
- HTTP access logs showing GET requests to index.php containing shell metacharacters such as ;, |, &, $(, or URL-encoded equivalents (%3B, %7C, %26)
- Unusual process activity such as sh, wget, curl, or nc spawned by the web server
Detection Strategies
- Inspect HTTP request logs on or in front of the charging station for suspicious query strings targeting index.php
- Deploy network IDS signatures that match command injection patterns in HTTP GET parameters destined for cPH2 devices
- Baseline normal device behavior and alert on deviations in process execution and outbound traffic
Monitoring Recommendations
- Forward HTTP and system logs from cPH2 devices to a centralized logging or SIEM platform for retention and correlation
- Monitor for anomalous outbound traffic from charging station IP ranges, particularly to unfamiliar destinations or non-standard ports
- Track firmware versions across the fleet to ensure inventory accuracy and identify unpatched devices
How to Mitigate CVE-2025-3883
Immediate Actions Required
- Restrict network access to cPH2 management interfaces using firewall rules or network segmentation, limiting reachability to trusted administrative hosts
- Place cPH2 charging stations on an isolated VLAN separated from corporate, guest, and operational technology networks
- Audit the charging station fleet for firmware version 2.0.4 and prioritize remediation for any exposed devices
Patch Information
Consult the vendor and the Zero Day Initiative advisory ZDI-25-249 for updates on firmware releases addressing this vulnerability. Apply vendor-supplied firmware updates as soon as they become available.
Workarounds
- Block external access to the cPH2 HTTP interface at the perimeter and restrict internal access to a hardened management subnet
- Disable or filter access to the index.php endpoint where feasible until a patched firmware build is deployed
- Require VPN or jump-host access for any administrative interaction with charging stations
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
