CVE-2025-27804 in cPH2 Charging Station
Summary
by MITRE • 05/21/2025
Several OS command injection vulnerabilities exist in the device firmware in the /var/salia/mqtt.php script. By publishing a specially crafted message to a certain MQTT topic arbitrary OS commands can be executed with root permissions.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 05/21/2025
The vulnerability identified as CVE-2025-27804 represents a critical operating system command injection flaw within device firmware, specifically located in the /var/salia/mqtt.php script. This weakness enables remote attackers to execute arbitrary operating system commands with the highest level of system privileges, effectively granting them complete control over the affected device. The vulnerability stems from insufficient input validation and sanitization within the MQTT message processing functionality, allowing malicious actors to inject and execute harmful commands directly through the device's messaging interface. The flaw exists at the intersection of IoT device management protocols and improper security controls in firmware implementation, creating a pathway for attackers to escalate privileges and compromise the entire system.
The technical exploitation of this vulnerability occurs through the MQTT protocol, which is commonly used for lightweight communication in IoT environments. Attackers can publish specially crafted messages to specific MQTT topics that are processed by the vulnerable script, bypassing normal authentication and authorization mechanisms. The script fails to properly sanitize or validate incoming MQTT payloads before executing any embedded commands, creating a direct injection vector that allows arbitrary code execution. This type of vulnerability aligns with CWE-78, which specifically addresses OS Command Injection, and represents a severe privilege escalation issue since the commands are executed with root permissions. The attack surface is particularly concerning given that MQTT is widely deployed in industrial IoT scenarios where devices often operate with elevated privileges and may control critical infrastructure components.
The operational impact of CVE-2025-27804 extends far beyond simple unauthorized access, as successful exploitation provides attackers with complete system compromise and persistent control over affected devices. This vulnerability enables adversaries to modify device configurations, install malicious software, exfiltrate sensitive data, or use compromised devices as launching points for further attacks within network perimeters. The root-level execution capability means that attackers can manipulate system files, disable security features, create backdoors, or establish persistent access that survives device reboots. From an adversarial perspective, this vulnerability maps directly to ATT&CK technique T1059.001 for command and scripting interpreter and T1068 for exploit for privilege escalation, making it a particularly attractive target for sophisticated threat actors seeking to establish long-term presence in network environments. The vulnerability's impact is amplified in industrial control systems and smart city infrastructure where device compromise could lead to operational technology disruptions or safety hazards.
Mitigation strategies for CVE-2025-27804 must address both immediate remediation and long-term security architecture improvements. Organizations should implement immediate firmware updates from vendors to patch the vulnerable mqtt.php script, ensuring that all MQTT message processing includes proper input validation and sanitization. Network segmentation should be enforced to limit MQTT communication to trusted sources and implement strict access controls for MQTT topics. The principle of least privilege must be applied by configuring MQTT brokers to restrict command execution capabilities and implement message filtering to prevent malicious payloads from reaching vulnerable endpoints. Additional protective measures include implementing MQTT traffic monitoring to detect anomalous command injection patterns, deploying intrusion detection systems specifically configured to identify command injection attempts, and establishing comprehensive device inventory management to track all MQTT-enabled devices within the network infrastructure. Security monitoring should include regular vulnerability assessments of firmware components and continuous verification of MQTT communication protocols to prevent similar injection vulnerabilities from emerging in future deployments.