Threat database

The Mennekes Amtron series (firmware versions ≤ 5.22.3) is vulnerable to privilege escalation. An authenticated low-privileged user can change the passwords of the admin (operator) and manufacturer accounts via crafted POST requests.

The Mennekes Amtron series (firmware versions ≤ 5.22.3) is vulnerable to an authentication bypass. An unauthenticated remote attacker can change the password of the user account via a crafted POST request to the /operator/operator endpoint.

CVE-2025-22366 is a high-severity OS command injection vulnerability affecting Mennekes Smart / Premium charging stations firmware versions prior to 2.15. The flaw arises from improper neutralization of special elements in OS commands during the authenticated firmware update process, potentially allowing an attacker with limited privileges to execute arbitrary OS commands. The vulnerability has a CVSS 4.0 base score of 8.7, indicating a significant security risk. No known exploits are reported in the wild, and no official patch links are provided in the input data.