CVE-2023-49958

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

An issue was discovered in Dalmann OCPP.Core through 1.2.0 for OCPP (Open Charge Point Protocol) for electric vehicles. The server processes mishandle StartTransaction messages containing additional, arbitrary properties, or duplicate properties. The last occurrence of a duplicate property is accepted. This could be exploited to alter transaction records or impact system integrity.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Weakness enumeration

CWE-20

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://github.com/dallmann-consulting/OCPP.Core/issues/36Exploit, Issue Tracking, Vendor Advisory
https://github.com/dallmann-consulting/OCPP.Core/issues/36Exploit, Issue Tracking, Vendor Advisory

Timeline

Published: Dec 7, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-499599.8In Indo-Sol PROFINET-INspektor NT through 2.4.0, a command injection vulnerability in the gedtupdater service of the firmware allows remote CVE-2023-49968.8Netskope was made aware of a security vulnerability in its NSClient product for version 100 & prior where a malicious non-admin user can dis CVE-2023-499607.5In Indo-Sol PROFINET-INspektor NT through 2.4.0, a path traversal vulnerability in the httpuploadd service of the firmware allows remote att CVE-2023-499617.5WALLIX Bastion 7.x, 8.x, 9.x and 10.x and WALLIX Access Manager 3.x and 4.x have Incorrect Access Control which can lead to sensitive data e CVE-2023-499638.8DYMO LabelWriter Print Server through 2.366 contains a backdoor hard-coded password that could allow an attacker to take control.CVE-2023-499648.8An issue was discovered in Hyland Alfresco Community Edition through 7.2.0. By inserting malicious content in the folder.get.html.ftl file, CVE-2023-499656.8SpaceX Starlink Wi-Fi router Gen 2 before 2023.48.0 allows XSS via the ssid and password parameters on the Setup Page.CVE-2023-499677.5Typecho v1.2.1 was discovered to be vulnerable to an XML Quadratic Blowup attack via the component /index.php/action/xmlrpc.CVE-2023-499687.3Customer Support System v1 was discovered to contain a SQL injection vulnerability via the id parameter at /customer_support/manage_departme CVE-2023-499694.3Customer Support System v1 was discovered to contain a SQL injection vulnerability via the id parameter at /customer_support/index.php?page=CVE-2023-49978.8Improper authorisation of regular users in ProIntegra Uptime DC software (versions below 2.0.0.33940) allows them to change passwords of all CVE-2023-499709.8Customer Support System v1 was discovered to contain a SQL injection vulnerability via the subject parameter at /customer_support/ajax.php?a