CVE-2024-44843

MEDIUM

SteVe 3.7.1 - Improper Authentication via Crafted OCPP Requests

Title source: llm

Description

An issue in the web socket handshake process of SteVe v3.7.1 allows attackers to bypass authentication and execute arbitrary coammands via supplying crafted OCPP requests.

References (3)

Core 3

Core References

Exploit, Third Party Advisory

https://gist.github.com/Badranh/94359664799db6d4709871f0c353f476

Product

https://github.com/steve-community/steve/blob/master/src/main/java/de/rwth/idsg/steve/ocpp/ws/OcppWebSocketHandshakeHandler.java

View Writeup ZIP pw:eip

Issue Tracking

https://github.com/steve-community/steve/issues/1546

Scores

CVSS v3 5.9

EPSS 0.0038

EPSS Percentile 29.8%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:L/A:L

CISA SSVC

Vulnrichment

Exploitation poc

Automatable yes

Technical Impact total

Details

CWE

CWE-287

Status published

Products (1)

steve-community/steve 3.7.1

Published Apr 15, 2025

Tracked Since Feb 18, 2026