No known public exploitation specifically targeting these vulnerabilities has been reported to CISA at this time.
Credit: CISA
From CISA's machine-readable CSAF 2.0 advisory (JSON).
| CVE | Weakness | CVSS v3 | Details |
|---|---|---|---|
| CVE-2025-10371 | CWE-434 Unrestricted Upload of File with Dangerous Type | 7.3 High |
A security flaw has been discovered in eCharge Hardy Barth Salia PLCC 2.3.81. This issue affects some unknown processing of the file /api.php. The manipulation of the argument setrfidlist results in unrestricted upload. The attack may be performed from remote. The exploit has been released to the public and may be exploited. The vendor was contacted early about this disclosure but did not respond in any way. CISA SSVC — Exploitation: PoC · Automatable: Yes Mitigation: Hardy Barth has published the eCharge firmware version 2.4.0 which corrects CVE-2025-10371 (api.php). and CVE-2025-5873 (firmware.php). The updated firmware is available here: https://firmware-download.echarge.de/. Note that authentication is required to acce… ↗ Mitigation: Furthermore, Hardy Barth has modified their firmware based web portal to eliminate direct unauthenticated access to the web interface. Mitigation: Contact Hardy Barth using their contact page here: https://www.hardy-barth.de/de/kontakt for more information. ↗ Affected, fixed & timelineAffected:
Mitigation: Alternatively, Hardy Barth can also be contacted through their eCharge brand here: https://www.echarge.de/en/contact_company |
| CVE-2025-5873 | CWE-434 Unrestricted Upload of File with Dangerous Type | 6.3 Medium |
A vulnerability was found in eCharge Hardy Barth Salia PLCC 2.3.81. It has been declared as critical. This vulnerability affects unknown code of the file /firmware.php of the component Web UI. The manipulation of the argument media leads to unrestricted upload. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. CISA SSVC — Exploitation: PoC · Automatable: No Mitigation: Hardy Barth has published the eCharge firmware version 2.4.0 which corrects CVE-2025-10371 (api.php). and CVE-2025-5873 (firmware.php). The updated firmware is available here: https://firmware-download.echarge.de/. Note that authentication is required to acce… ↗ Mitigation: Furthermore, Hardy Barth has modified their firmware based web portal to eliminate direct unauthenticated access to the web interface. Mitigation: Contact Hardy Barth using their contact page here: https://www.hardy-barth.de/de/kontakt for more information. ↗ Affected, fixed & timelineAffected:
Mitigation: Alternatively, Hardy Barth can also be contacted through their eCharge brand here: https://www.echarge.de/en/contact_company |
Scores and weakness types are as CISA or the republishing vendor stated them in this advisory; the linked CVE pages carry the independently enriched CVSS and SSVC assessments.
No coverage found in monitored research blogs or news feeds.
| CVE | CVSS | Affected |
|---|---|---|
| CVE-2025-10371 | 6.9 Medium | eCharge Hardy Barth Salia PLCC A security flaw has been discovered in eCharge Hardy Barth Salia PLCC up to 2.3.81. This issue affects some unknown processing of the file /api.php. … |
| CVE-2025-5873 | 5.3 Medium | eCharge Hardy Barth Salia PLCC A vulnerability was detected in eCharge Hardy Barth Salia PLCC up to 2.3.81. Affected by this issue is some unknown functionality of the file /firmwa… |
Named by the advisory itself. Each CVE links to its tracked detail page.
No KEV-catalogued vendors are named in this publication.