CVE-2024-5684

An attacker with access to the private network (the charger is connected to) or local access to the Ethernet-Interface can exploit a faulty implementation of the JWT-library in order to bypass the password authentication to the web configuration interface and then has full access as the user would have. However, an attacker will not have developer or admin rights. If the implementation of the JWT-library is wrongly configured to accept "none"-algorithms, the server will pass insecure JWT. A local, unauthenticated attacker can exploit this vulnerability to bypass the authentication mechanism.

• CWE-345
• CWE-345

• https://asrg.io/security-advisories/vulnerability-in-id-charger-connect-and-pro-from-volkswagen-group-charging-gmbh-elli-evbox-versions-spr3-2b-spr3-51-and-spr3-52/Third Party Advisory
• https://asrg.io/security-advisories/vulnerability-in-id-charger-connect-and-pro-from-volkswagen-group-charging-gmbh-elli-evbox-versions-spr3-2b-spr3-51-and-spr3-52/Third Party Advisory

Published

Jun 6, 2024

Last Modified

Jun 17, 2026

Status

Modified

• Same Subject, Wrong User: A Cross-Issuer Account Takeover in n8nStrix found an identity-binding bug in n8n's token-exchange flow enabling account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-56830The Net::EasyTCP package 0.15 through 0.26 for Perl uses Per…5.4
• CVE-2024-56835A vulnerability has been identified in RUGGEDCOM ROX MX5000 …8.8
• CVE-2024-56836A vulnerability has been identified in RUGGEDCOM ROX MX5000 …8.8
• CVE-2024-56837A vulnerability has been identified in RUGGEDCOM ROX MX5000 …8.6
• CVE-2024-56838A vulnerability has been identified in RUGGEDCOM ROX MX5000 …8.6
• CVE-2024-56839A vulnerability has been identified in RUGGEDCOM ROX MX5000 …8.6
• CVE-2024-56840A vulnerability has been identified in RUGGEDCOM ROX MX5000 …7.5
• CVE-2024-56841A vulnerability has been identified in Mendix LDAP (All vers…9.1
• CVE-2024-5685Users with "User:edit" and "Self:api" permissions can promot…8.1
• CVE-2024-5686The WPZOOM Addons for Elementor (Templates, Widgets) plugin …5.4
• CVE-2024-5687If a specific sequence of actions is performed when opening …5.3
• CVE-2024-5688If a garbage collection was triggered at the right time, a u…8.1