CVE-2025-5873: eCharge Hardy Barth Salia PLCC RCE Vulnerability

CVE-2025-5873 Overview

CVE-2025-5873 affects eCharge Hardy Barth Salia PLCC electric vehicle charging controllers up to version 2.3.81. The vulnerability resides in the /firmware.php endpoint of the Web UI. Attackers can manipulate the media argument to perform an unrestricted file upload against the device.

The issue is remotely exploitable and a public exploit is available. The vendor was contacted about this disclosure but did not respond. The weakness is classified as improper access control [CWE-284].

Critical Impact
Authenticated remote attackers can upload arbitrary files to the Salia PLCC firmware endpoint, potentially altering charger behavior and firmware integrity.

Affected Products

eCharge Hardy Barth Salia PLCC versions up to and including 2.3.81
Web UI component exposing /firmware.php
Salia PLCC Slave firmware v2.2.0 (referenced in the public proof of concept)

Discovery Timeline

2025-06-09 - CVE-2025-5873 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-5873

Vulnerability Analysis

The vulnerability is an unrestricted file upload in the firmware.php handler of the Salia PLCC Web UI. The media parameter accepts attacker-supplied content without proper validation of file type, extension, or destination. An authenticated remote attacker can submit crafted HTTP requests to place arbitrary files onto the device.

Because the endpoint governs firmware-related operations on a charging controller, uploaded content can influence the operation of an internet-connected industrial device. The EPSS score is 0.319%, and a public proof of concept is available on GitHub. The vendor did not respond to disclosure attempts, so no coordinated fix has been published.

Root Cause

The root cause is improper access control on the firmware upload functionality [CWE-284]. The firmware.php script processes the media parameter without enforcing restrictions on the file type or origin. Missing server-side validation allows attacker-controlled data to be written where only trusted firmware artifacts should reside.

Attack Vector

The attack is executed over the network against the device's Web UI. An attacker with low-privileged access sends a manipulated HTTP request to /firmware.php and supplies malicious content in the media argument. Public documentation of the exploit lowers the barrier for opportunistic attackers targeting exposed Salia PLCC controllers.

No verified exploitation code is reproduced here. Technical reproduction steps are documented in the public proof of concept.

Detection Methods for CVE-2025-5873

Indicators of Compromise

HTTP POST requests to /firmware.php containing a media parameter from unexpected source IP addresses.
Unrecognized files present in firmware or media storage directories on the charging controller.
Unauthenticated or unexpected authenticated sessions preceding firmware endpoint activity.

Detection Strategies

Inspect web server access logs on the Salia PLCC device for requests to /firmware.php with attached content.
Alert on file uploads that do not match the vendor's firmware naming conventions or expected sizes.
Correlate management-interface access with source addresses outside authorized operator networks.

Monitoring Recommendations

Continuously monitor network flows to and from the charger management interface for anomalous upload activity.
Track configuration and firmware changes and validate them against a known-good baseline.
Forward device and network logs to a central analytics platform for retention and correlation.

How to Mitigate CVE-2025-5873

Immediate Actions Required

Remove Salia PLCC Web UI exposure from the public internet and restrict access to trusted management networks.
Rotate all administrative credentials used to authenticate to the charger Web UI.
Audit /firmware.php request history and firmware storage for unauthorized uploads.
Isolate affected chargers on a segmented VLAN until a vendor fix is available.

Patch Information

No vendor patch is available at the time of publication. The vendor did not respond to disclosure attempts. Operators should track vendor communications from eCharge Hardy Barth for future firmware updates addressing versions up to 2.3.81. Refer to the VulDB entry for updates.

Workarounds

Place the charger management interface behind a VPN or jump host requiring multi-factor authentication.
Enforce firewall rules that permit access to /firmware.php only from authorized operator IP addresses.
Disable or block the Web UI when active administration is not required.
Monitor for and block anomalous requests targeting the firmware upload endpoint at the network perimeter.

bash

# Example firewall rule restricting access to the charger Web UI
iptables -A INPUT -p tcp --dport 443 -s 10.0.10.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -j DROP