CVE-2025-3882

eCharge Hardy Barth cPH2 nwcheckexec.php dest Command Injection Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of eCharge Hardy Barth cPH2 charging stations. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of the dest parameter provided to the nwcheckexec.php endpoint. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of the www-data user. Was ZDI-CAN-23114.

• CWE-78

• https://www.zerodayinitiative.com/advisories/ZDI-25-248/Third Party Advisory

Published

May 22, 2025

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-3876The SMS Alert Order Notifications – WooCommerce plugin for W…8.8
• CVE-2025-3877Rejected reason: This CVE was marked as fixed, but due to ot…
• CVE-2025-3878The SMS Alert Order Notifications – WooCommerce plugin for W…5.4
• CVE-2025-3879Vault Community, Vault Enterprise (“Vault”) Azure Auth metho…8.8
• CVE-2025-3880The Poll, Survey & Quiz Maker Plugin by Opinion Stage plugin…4.3
• CVE-2025-3881eCharge Hardy Barth cPH2 check_req.php ntp Command Injection…8.8
• CVE-2025-3883eCharge Hardy Barth cPH2 index.php Command Injection Remote …8.8
• CVE-2025-3884Cloudera Hue Ace Editor Directory Traversal Information Disc…7.5
• CVE-2025-3885Harman Becker MGU21 Bluetooth Improper Input Validation Deni…6.5
• CVE-2025-3886An issue in CatoNetworks CatoClient before v.5.8.0 allows at…8.1
• CVE-2025-3887GStreamer H265 Codec Parsing Stack-based Buffer Overflow Rem…8.8
• CVE-2025-3888The Jupiter X Core plugin for WordPress is vulnerable to Sto…5.4