CVE-2021-45876

CRITICAL

GARO Wallbox GLB/GTB/GTC Firmware < 185 - Unauthenticated Command Injection via downloadAndUpdate URL Parameter

Title source: llm
STIX 2.1

Description

Multiple versions of GARO Wallbox GLB/GTB/GTC are affected by unauthenticated command injection. The url parameter of the function module downloadAndUpdate is vulnerable to an command Injection. Unfiltered user input is used to generate code which then gets executed when downloading new firmware.

References (1)

Core 1
Core References
Third Party Advisory x_refsource_misc
https://github.com/delikely/advisory/tree/main/GARO

Scores

CVSS v3 9.8
EPSS 0.0146
EPSS Percentile 70.3%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Details

CWE
CWE-77
Status published
Products (3)
garo/wallbox_glb_firmware < 185
garo/wallbox_gtb_firmware < 185
garo/wallbox_gtc_firmware < 185
Published Mar 21, 2022
Tracked Since Feb 18, 2026