Charging Pile Cloud Platform
Monthly
Authentication bypass in Kehua Charging Pile Cloud Platform 1.0 exposes the /home endpoint to unauthenticated remote attackers via manipulation of authentication controls, classified under CWE-287 (Improper Authentication). The CVSS 4.0 vector confirms no privileges or user interaction are required (PR:N/UI:N/AV:N/AC:L), with partial confidentiality, integrity, and availability impact against the vulnerable system. A public proof-of-concept exploit has been disclosed with no vendor response or patch available, elevating practical risk despite a low EPSS score of 0.17% (38th percentile) and absence from the CISA KEV catalog.
SQL injection in Kehua Charging Pile Cloud Platform 1.0 endpoint /sys/task/findAllTask allows authenticated remote attackers to execute arbitrary SQL queries with limited confidentiality and integrity impact. The vulnerability has a publicly available exploit and was disclosed to the vendor without response, though EPSS score of 0.04% suggests low real-world exploitation probability despite public POC availability.
Authentication bypass in Kehua Charging Pile Cloud Platform 1.0 exposes the /home endpoint to unauthenticated remote attackers via manipulation of authentication controls, classified under CWE-287 (Improper Authentication). The CVSS 4.0 vector confirms no privileges or user interaction are required (PR:N/UI:N/AV:N/AC:L), with partial confidentiality, integrity, and availability impact against the vulnerable system. A public proof-of-concept exploit has been disclosed with no vendor response or patch available, elevating practical risk despite a low EPSS score of 0.17% (38th percentile) and absence from the CISA KEV catalog.
SQL injection in Kehua Charging Pile Cloud Platform 1.0 endpoint /sys/task/findAllTask allows authenticated remote attackers to execute arbitrary SQL queries with limited confidentiality and integrity impact. The vulnerability has a publicly available exploit and was disclosed to the vendor without response, though EPSS score of 0.04% suggests low real-world exploitation probability despite public POC availability.