CVE-2023-46360 is a high severity (CVSS 8.8) execution with unnecessary privileges flaw in Hardy Barth cPH2 eCharge charging stations. The record says v1.87.0 and earlier; the researcher write-up says versions below 2.0.0. Update to firmware 2.0.0 or later, and keep the stations off the internet.
What's affected
The NVD record says v1.87.0 and earlier and gives no more detail. The Offensity write-up says both this CVE and CVE-2023-46359 affect any cPH2 station with a version below 2.0.0. It describes the web service account (www-data) as holding passwordless sudo rights it did not need.
The fix named in the write-up is version 2.0.0 or later, available from the vendor firmware page at salia.echarge.de/firmware. The weakness is CWE-250. The vector needs a low privilege login, which the sibling command injection flaw can supply.
The NVD record scores it 8.8 (High) with the vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. The weakness class is CWE-250 (execution with unnecessary privileges). The record does not list this CVE in the CISA Known Exploited Vulnerabilities catalog, and nothing we read says it is exploited in the wild.
How to check if you're exposed
Read the firmware version from the station's web interface. A version below 2.0.0 is in range. Then look at how the station is networked and who can reach its management page.
If you manage many stations, keep one list with location, serial number, firmware and network segment.
What to do now
- Update every cPH2 station to firmware 2.0.0 or later.
- Isolate stations on a separate network segment with no inbound internet access.
- Limit management access to named administrators.
- Treat CVE-2023-46359 and this CVE together, since one can lead to the other.
- Record firmware versions in your asset list.
Why it matters
Least privilege says a service should only hold the rights it needs. When a web service can run anything as root through sudo, any bug in that service becomes a full device takeover. The write-up describes exactly this arrangement.
On its own the flaw needs a foothold. Combined with the command injection in CVE-2023-46359, a remote attacker can go from running a command as the web user to controlling the device. Fixing both with one firmware update is the simple route.
Quick check
Is this related to CVE-2023-46359?
Yes. Both come from the same research and the same firmware range. One gives command execution and the other turns it into higher privilege.
Is there a workaround?
The sources do not list one. Update the firmware and isolate the device.
Sources
Last reviewed: 19 October 2026.
