CVE-2023-46359 is a critical severity (CVSS 9.8) OS command injection in the connectivity check feature of Hardy Barth cPH2 eCharge charging stations. An unauthenticated remote attacker may run commands on the device. The record says v1.87.0 and earlier; the researcher write-up says versions below 2.0.0. Update to 2.0.0 or later.
What's affected
There is a small difference in how the sources state the range. The NVD record says Hardy Barth cPH2 eCharge Ladestation v1.87.0 and earlier. The Offensity write-up says both CVE-2023-46359 and CVE-2023-46360 affect any cPH2 station with a version below 2.0.0. Both lead to the same advice: be on 2.0.0 or later.
The write-up points to the vendor firmware page at salia.echarge.de/firmware for updates. The weakness is CWE-78. A companion record, CVE-2023-46360, covers excessive privileges on the same product.
The NVD record scores it 9.8 (Critical) with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. The weakness class is CWE-78 (OS command injection). The record does not list this CVE in the CISA Known Exploited Vulnerabilities catalog, and nothing we read says it is exploited in the wild.
How to check if you're exposed
Open the charging station's web interface and read the firmware version on the status or information page. If it is below 2.0.0, it is in range. Also check how the station is reachable: whether it sits on a flat office or home network, or has an address exposed to the internet.
For fleets, record each station's serial number and firmware in a list so you can see what remains.
What to do now
- Download firmware 2.0.0 or later from the vendor firmware page and update each station.
- Put charging stations on their own network segment with no inbound access from the internet.
- Restrict access to the web interface to administrators.
- Change default credentials if any remain.
- Keep a list of every station and its firmware version.
Why it matters
Command injection means input to a feature ends up inside a command that the operating system runs. A connectivity check is a natural place for this, because it passes a host name to a network tool. The write-up reports that the web service account also held more privileges than it needed, which is why the same product has a separate privilege record.
A charging station can sit on a corporate or home network and can hold network credentials. A compromised device is a foothold, and an outage affects people who need to charge.
Quick check
What version should I be on?
2.0.0 or later, according to the researcher write-up.
Does the attacker need an account?
The record describes an unauthenticated remote attacker.
Sources
Last reviewed: 19 October 2026.
