CVE-2025-22370

Executive Summary

CVE-2025-22370 is a critical SQL injection vulnerability discovered in the web configuration interface of Mennekes Smart and Premium Chargingpoints. The vulnerability arises from insufficient neutralization of user-supplied input across multiple fields in the web-based management interface. An unauthenticated, remote attacker can exploit this flaw to execute arbitrary SQL commands against the backend database, potentially leading to full compromise of the charging point’s configuration, user credentials, and operational data. No public proof-of-concept (PoC) or exploit code has been released as of this analysis, and no official patch is available. The CVSS v3.1 base score is estimated at 9.8 (Critical) due to network attack vector, low attack complexity, no privileges required, and no user interaction needed.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – Exploitable remotely over the network.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): None (N) – No user action required.
• Scope (S): Unchanged (U) – The vulnerable component is the database.
• Confidentiality (C): High (H) – Full database read access.
• Integrity (I): High (H) – Ability to modify or delete database records.
• Availability (A): High (H) – Potential to disrupt charging point operations.

Threat Level: Critical. The combination of remote exploitability, no authentication, and full database control makes this a high-priority vulnerability for any organization using Mennekes charging infrastructure.

Deep Dive & Mechanics

The vulnerability resides in the web configuration interface of Mennekes Smart and Premium Chargingpoints. The interface likely uses a SQL database (e.g., SQLite or MySQL) to store configuration parameters, user accounts, and operational logs. Multiple input fields (e.g., network settings, user management, charging profiles) fail to sanitize or parameterize user-supplied data before constructing SQL queries.

An attacker can inject SQL commands by submitting specially crafted strings into any of these fields. For example, a simple injection like ' OR '1'='1 in a username field could bypass authentication, while more complex payloads could extract data, modify configurations, or even execute operating system commands if the database has sufficient privileges.

The lack of parameterized queries or prepared statements is the root cause. The application likely concatenates user input directly into SQL statements, allowing the attacker to break out of the intended query structure.

Vulnerable vs. Patched Code

Since no patch is available, the vulnerable code pattern is described generically. The patched version would use parameterized queries.

Vulnerable Code (Python/Flask example):

@app.route('/config/update', methods=['POST'])
def update_config():
    field = request.form['field']
    value = request.form['value']
    query = f"UPDATE config SET {field} = '{value}' WHERE id = 1"
    cursor.execute(query)
    db.commit()

Patched Code (Parameterized):

@app.route('/config/update', methods=['POST'])
def update_config():
    field = request.form['field']
    value = request.form['value']
    # Whitelist allowed fields
    allowed_fields = ['network_ssid', 'admin_email', 'timezone']
    if field not in allowed_fields:
        return "Invalid field", 400
    query = f"UPDATE config SET {field} = ? WHERE id = 1"
    cursor.execute(query, (value,))
    db.commit()

The patched version uses a whitelist for field names and parameterized queries for values, preventing SQL injection.

Exploitation & Lab Setup

Red Team (Exploitation)

Lab Environment:

• A Mennekes Smart or Premium Chargingpoint with firmware version vulnerable to CVE-2025-22370.
• Network access to the web interface (default port 80 or 443).
• Tools: sqlmap, curl, Burp Suite, or custom Python scripts.

Exploitation Steps:

1. Identify vulnerable fields: Use a web proxy to intercept requests to the configuration interface. Look for POST parameters like username, password, ssid, ip_address, etc.
2. Test for injection: Submit a single quote (') in a field and observe error messages or behavior changes.
3. Automate with sqlmap:

   sqlmap -u "http://<target>/config/update" --data="field=ssid&value=test" --batch --dbs
   

4. Extract data: Once injection is confirmed, dump the database:

   sqlmap -u "http://<target>/config/update" --data="field=ssid&value=test" --batch --dump
   

5. Escalate privileges: Look for admin credentials or configuration files that allow remote code execution.

Manual Payload Example:

' UNION SELECT 1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50,51,52,53,54,55,56,57,58,59,60,61,62,63,64,65,66,67,68,69,70,71,72,73,74,75,76,77,78,79,80,81,82,83,84,85,86,87,88,89,90,91,92,93,94,95,96,97,98,99,100 --

Blue Team (Defense & Detection)

Detection Steps:

1. Monitor web logs: Look for SQL injection patterns in POST parameters (e.g., ' OR, UNION, --).
2. Deploy WAF rules: Block requests containing SQL keywords in unexpected fields.
3. Network segmentation: Isolate charging points from the internet and critical internal networks.
4. Honeypot fields: Add fake configuration fields that trigger alerts when accessed.

Hunting Query (Splunk):

index=web_logs sourcetype=access_combined
| search uri="/config/update" AND (form_data=*'* OR form_data=*UNION* OR form_data=*--*)
| table _time, src_ip, uri, form_data, status

Indicators of Compromise (IOCs)

• Network IOCs:

  • Unusual SQL keywords in HTTP POST requests to /config/update or similar endpoints.
  • Repeated failed login attempts followed by successful data extraction.
  • Outbound database connections from the charging point to unknown IPs (if data exfiltration occurs).

• Host IOCs:

  • Modified configuration files (e.g., /etc/config.db or similar).
  • Unexpected user accounts in the local database.
  • Log entries showing SQL errors or injection attempts.

• File IOCs:

  • Temporary files created by sqlmap or similar tools on the attacker’s machine (not on the device).

Detection Engineering

YARA Rule

rule CVE_2025_22370_SQL_Injection {
    meta:
        description = "Detects SQL injection attempts targeting Mennekes charging point web interface"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-22370"
    strings:
        $sqli1 = /'.*OR.*'/
        $sqli2 = /UNION.*SELECT/
        $sqli3 = /--/
        $sqli4 = /'.*AND.*'/
    condition:
        any of ($sqli*) and filesize < 10KB
}

Sigma Rule

title: SQL Injection Attempt Against Mennekes Charging Point
id: 8a9b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d
status: experimental
description: Detects SQL injection patterns in HTTP POST requests to Mennekes configuration interface
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query: '/config/update*'
    keywords:
        - "' OR"
        - "UNION SELECT"
        - "'--"
        - "1=1"
    condition: selection and keywords
falsepositives:
    - Legitimate use of special characters in configuration values (rare)
level: high

Suricata Rule

alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"CVE-2025-22370 SQL Injection Attempt"; flow:to_server,established; content:"POST"; http_method; content:"/config/update"; http_uri; pcre:"/(\x27OR\x27|\x27--|UNION\x20SELECT|1=1)/i"; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Isolate affected devices: Place Mennekes charging points on a separate VLAN with strict firewall rules blocking inbound internet access.
2. Disable remote management: If not required, disable the web configuration interface entirely.
3. Monitor logs: Enable detailed logging and alert on SQL injection patterns.

Long-Term Fixes:

1. Vendor patch: Await an official firmware update from Mennekes that implements parameterized queries.
2. Custom WAF: Deploy a web application firewall (e.g., ModSecurity) with rules to block SQL injection.
3. Code review: If source code is available, audit all database interactions for proper input sanitization.

Workaround:

• Use a reverse proxy (e.g., Nginx) to filter malicious requests before they reach the charging point:

location /config/update {
    if ($request_body ~* "(\x27OR\x27|\x27--|UNION\x20SELECT|1=1)") {
        return 403;
    }
    proxy_pass http://charging_point;
}

Valters IT
Securing EV Charging Infrastructure