CVE-2025-48415 in cPH2 Charging Station
Summary
by MITRE • 05/21/2025
A USB backdoor feature can be triggered by attaching a USB drive that contains specially crafted "salia.ini" files. The .ini file can contain several "commands" that could be exploited by an attacker to export or modify the device configuration, enable an SSH backdoor or perform other administrative actions. Ultimately, this backdoor also allows arbitrary execution of OS commands.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 05/21/2025
This vulnerability represents a critical security flaw in device firmware that leverages the ubiquitous USB interface to establish persistent unauthorized access. The attack vector exploits the legitimate USB storage functionality by embedding malicious configuration files within USB drives that, when connected to affected devices, trigger a hidden backdoor mechanism. The specific file "salia.ini" serves as the payload delivery mechanism, containing command structures that bypass normal authentication and authorization controls. This represents a sophisticated attack pattern that combines physical access exploitation with remote command execution capabilities, effectively transforming a standard USB connection into a sophisticated attack surface. The vulnerability demonstrates a fundamental failure in input validation and privilege separation within the device's USB handling subsystem, allowing unauthenticated users to escalate privileges through seemingly benign file operations.
The technical implementation of this vulnerability stems from inadequate sanitization of configuration files loaded from external storage devices. When the device processes the specially crafted "salia.ini" file, it fails to properly validate the command structures contained within, allowing arbitrary code execution through the configuration parsing mechanism. This flaw aligns with CWE-20: Improper Input Validation, where the system accepts malformed input without sufficient validation checks. The vulnerability operates at the firmware level, meaning that traditional operating system security controls may be bypassed entirely, as the malicious commands execute within the device's privileged execution context. The ability to enable SSH backdoors and export device configurations indicates that the attack chain includes multiple stages of privilege escalation and persistence establishment, potentially allowing attackers to maintain long-term access to compromised systems.
The operational impact of this vulnerability extends far beyond simple unauthorized access, as it enables complete compromise of affected devices through physical proximity attacks. Attackers can leverage this vulnerability to establish persistent backdoors, exfiltrate sensitive configuration data, and perform administrative functions that would normally require legitimate administrative credentials. The arbitrary command execution capability means that attackers can install malware, modify system files, or even disable security features entirely. This vulnerability particularly affects devices that support USB mass storage and configuration file processing, including network appliances, embedded systems, and industrial control devices. The implications for critical infrastructure and enterprise environments are severe, as attackers with physical access to network equipment can silently compromise entire network segments without detection, representing a significant threat to operational technology environments.
Mitigation strategies must address both the immediate vulnerability and broader security architecture gaps. Device manufacturers should implement strict input validation for all configuration file formats, including signature verification and whitelisting of command structures. Network segmentation and USB port restrictions should be enforced at the enterprise level to prevent unauthorized USB device connections. Regular firmware updates and security patches should be deployed immediately upon vulnerability disclosure, with automated update mechanisms to ensure timely remediation. Organizations should implement USB device control policies that restrict which devices can be connected to critical systems, combined with network monitoring to detect unusual SSH access patterns or configuration changes. The vulnerability also highlights the importance of supply chain security, as attackers may compromise USB drives during manufacturing or distribution to deliver payloads directly to target systems. Security teams should conduct regular vulnerability assessments targeting firmware components and implement continuous monitoring for unauthorized configuration modifications that could indicate exploitation attempts.