CVE-2023-49955

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

An issue was discovered in Dalmann OCPP.Core before 1.2.0 for OCPP (Open Charge Point Protocol) for electric vehicles. It does not validate the length of the chargePointVendor field in a BootNotification message, potentially leading to server instability and a denial of service when processing excessively large inputs. NOTE: the vendor's perspective is "OCPP.Core is intended for use in a protected environment/network."

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://github.com/dallmann-consulting/OCPP.Core/issues/32Exploit, Issue Tracking, Vendor Advisory
https://github.com/dallmann-consulting/OCPP.Core/issues/32Exploit, Issue Tracking, Vendor Advisory

Timeline

Published: Dec 7, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-499567.5An issue was discovered in Dalmann OCPP.Core before 1.3.0 for OCPP (Open Charge Point Protocol) for electric vehicles. A StopTransaction mes CVE-2023-499577.5An issue was discovered in Dalmann OCPP.Core before 1.3.0 for OCPP (Open Charge Point Protocol) for electric vehicles. It permits multiple t CVE-2023-499587.5An issue was discovered in Dalmann OCPP.Core through 1.2.0 for OCPP (Open Charge Point Protocol) for electric vehicles. The server processes CVE-2023-499599.8In Indo-Sol PROFINET-INspektor NT through 2.4.0, a command injection vulnerability in the gedtupdater service of the firmware allows remote CVE-2023-49968.8Netskope was made aware of a security vulnerability in its NSClient product for version 100 & prior where a malicious non-admin user can dis CVE-2023-499607.5In Indo-Sol PROFINET-INspektor NT through 2.4.0, a path traversal vulnerability in the httpuploadd service of the firmware allows remote att CVE-2023-499617.5WALLIX Bastion 7.x, 8.x, 9.x and 10.x and WALLIX Access Manager 3.x and 4.x have Incorrect Access Control which can lead to sensitive data e CVE-2023-499638.8DYMO LabelWriter Print Server through 2.366 contains a backdoor hard-coded password that could allow an attacker to take control.CVE-2023-499648.8An issue was discovered in Hyland Alfresco Community Edition through 7.2.0. By inserting malicious content in the folder.get.html.ftl file, CVE-2023-499656.8SpaceX Starlink Wi-Fi router Gen 2 before 2023.48.0 allows XSS via the ssid and password parameters on the Setup Page.CVE-2023-499677.5Typecho v1.2.1 was discovered to be vulnerable to an XML Quadratic Blowup attack via the component /index.php/action/xmlrpc.CVE-2023-499687.3Customer Support System v1 was discovered to contain a SQL injection vulnerability via the id parameter at /customer_support/manage_departme