---
id: CVE-2025-22366
title: 'Mennekes smart/premium charges systems, Command injection in firmware upgrade'
summary: >-
  The authenticated firmware update capability of the firmware for Mennekes
  Smart / Premium Chargingpoints can be abused for command execution because OS
  command are improperly neutralized when certain fields are passed to the
  underlying OS.
severity: high
cvss: 8.7
cvssVector: 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:L/SI:N/SA:N/S:N/AU:Y'
cvssSource: cna
cwe:
  - CWE-78
  - CWE-250
vendor: Mennekes
product: Smart / Premium charging stations
affected:
  - smart_premium_charging_stations < 2.15
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2025-03-11T14:53:28.425309Z'
published: '2025-03-11'
updated: '2026-10-08'
sourceUpdated: '2026-10-08T19:56:35.185Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2025-22366'
references:
  - url: 'https://csirt.divd.nl/CVE-2025-22366'
  - url: 'https://csirt.divd.nl/DIVD-2025-00003'
  - url: >-
      https://www.mennekes.nl/fileadmin/MEN-Deutschland/emobility/04_software/06_smart_premium/Release_Notes_for_2.15_06.03.2025.pdf
tags:
  - cve.org
epss: 0.00647
epssPercentile: 0.50785
ingestedAt: '2026-10-15T00:02:07.326Z'
---

## Overview

The authenticated firmware update capability of the firmware for Mennekes Smart / Premium Chargingpoints can be abused for command execution because OS command are improperly neutralized when certain fields are passed to the underlying OS.

## Affected

- `smart_premium_charging_stations < 2.15`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.