← Back to CVEs
CVE-2020-8006
HIGH8.8
Description
The server in Circontrol Raption through 5.11.2 has a pre-authentication stack-based buffer overflow that can be exploited to gain run-time control of the device as root. The ocpp1.5 and pwrstudio binaries on the charging station do not use a number of common exploitation mitigations. In particular, there are no stack canaries and they do not use the Position Independent Executable (PIE) format.
CVE Details
CVSS v3.1 Score8.8
SeverityHIGH
CVSS VectorCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack VectorNETWORK
ComplexityLOW
Privileges RequiredLOW
User InteractionNONE
Published4/12/2024
Last Modified11/4/2025
Sourcenvd
Honeypot Sightings0
Affected Products
circontrol:raption_server
Weaknesses (CWE)
CWE-121
References
https://circontrol.com/intelligent-charging-solutions/dc-chargers-series/raption-150/(cve@mitre.org)
https://seclists.org/fulldisclosure/2024/Mar/33(cve@mitre.org)
http://seclists.org/fulldisclosure/2024/Mar/33(af854a3a-2127-422b-91ae-364da2661108)
https://circontrol.com/intelligent-charging-solutions/dc-chargers-series/raption-150/(af854a3a-2127-422b-91ae-364da2661108)
https://seclists.org/fulldisclosure/2024/Mar/33(af854a3a-2127-422b-91ae-364da2661108)
IOC Correlations
No correlations recorded
This product uses data from the NVD API but is not endorsed or certified by the NVD.