CVE-2023-30399
Description
Insecure permissions in the settings page of GARO Wallbox GLB/GTB/GTC before v189 allows attackers to redirect users to a crafted update package link via a man-in-the-middle attack.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
2- GARO/Wallbox GLB/GTB/GTCdescription
- Range: <v189
Patches
Vulnerability mechanics
Root cause
"Missing authentication on the firmware update interface allows an attacker to substitute the update URL via a man-in-the-middle attack."
Attack vector
An attacker on the network path can intercept the firmware update address displayed on the settings page and replace it with a link to a malicious update package. The device does not authenticate the update request, so the attacker can then trigger a firmware update that deploys a crafted Tomcat WAR file (e.g., a backdoor `serialweb.war`), achieving remote code execution with device management privileges [ref_id=1].
Affected code
The vulnerable interface is the firmware update page at `/serialweb/#settings` on port 8080. The update mechanism downloads a `.tgz` package (e.g., `chargebox_189.tgz`) and processes its contents, including `serialweb.war` and `SerialService.jar`, without verifying the integrity or authenticity of the package [ref_id=1].
What the fix does
The advisory does not provide a patch diff or fixed version number beyond stating that versions "before v189" are vulnerable [ref_id=1]. The recommended remediation is to enforce authentication on the firmware update API and to verify the integrity and authenticity of update packages (e.g., via cryptographic signing) to prevent man-in-the-middle substitution of malicious payloads [ref_id=1].
Preconditions
- networkAttacker must be on the network path between the GARO Wallbox and the update server (man-in-the-middle position).
- authThe device's firmware update API at /serialweb/#settings must be accessible without authentication.
- inputThe attacker must be able to intercept and modify the HTTP response that contains the firmware download URL.
Generated on May 26, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.
References
3News mentions
0No linked articles in our index yet.