PatchSiren

PatchSiren cyber security CVE debrief

CVE-2025-5873 Raw CVE debrief

CVE-2025-5873 is a remotely reachable web UI flaw in Hardy Barth Salia board firmware <=2.3.81. The advisory says the /firmware.php handler can be abused through the media parameter to trigger unrestricted file upload. CISA’s source notes public exploit disclosure and no vendor response to early coordination. The advisory describes the issue as critical, while the supplied CVSS 3.1 vector scores it 6.3 (Medium).

Vendor
Raw
Product
Hardy Barth Salia Board Firmware <=2.3.81
CVSS
MEDIUM 6.3
CISA KEV
Not listed in stored evidence
Original CVE published
2026-04-21
Original CVE updated
2026-07-30
Advisory published
2026-04-21
Advisory updated
2026-07-30

Who should care

Operators and maintainers of Hardy Barth Salia EV charge controllers, especially those exposing the Web UI on trusted or untrusted networks. OT/ICS teams responsible for remote management, perimeter controls, and asset inventory should treat this as relevant even if internet exposure is limited.

Technical summary

The published advisory states that unknown code in the Web UI component, specifically /firmware.php, accepts a manipulated media argument that leads to unrestricted upload. The attack is remote and does not require user interaction. Based on the supplied CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L), exploitation requires low privileges but can affect confidentiality, integrity, and availability at limited scope.

Defensive priority

High for any exposed management interface or systems used in operational EV charging environments. The combination of remote reachability, upload abuse, and public exploit disclosure increases urgency even though the supplied CVSS score is Medium.

Recommended defensive actions

  • Identify all Hardy Barth Salia deployments and confirm whether firmware is at or below 2.3.81.
  • Restrict access to the Web UI to approved management networks only; do not expose it to the internet.
  • Segment EV charging management interfaces from general user networks and other OT/IT zones.
  • Monitor for unexpected file uploads, new web content, or changes under the firmware/web UI paths.
  • Review authentication, logging, and administrative access controls around the device management interface.
  • Track CISA and vendor channels for remediation guidance or firmware updates; the source corpus does not provide a fixed version.
  • Apply CISA ICS recommended practices and defense-in-depth guidance referenced in the advisory.

Evidence notes

Grounded in CISA CSAF advisory ICSA-26-111-05 and the supplied CVSS 3.1 vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L. Timing context uses the supplied published/modified date of 2026-04-21T05:00:00.000Z. The source notes public exploit disclosure and vendor nonresponse to early coordination.

Sources and references

Verified primary and authoritative sources

  • CVE-2025-5873 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2025-5873

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2025-5873 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2025-5873

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source item URL

    Unverified legacy reference

    URL: https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2026/icsa-26-111-05.json

    cisa_csaf

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/news-events/ics-advisories/icsa-26-111-05

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/uscert/ics/alerts/ICS-ALERT-10-301-01

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/resources-tools/resources/ics-recommended-practices

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/sites/default/files/publications/Cybersecurity_Best_Practices_for_Industrial_Control_Systems.pdf

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/topics/industrial-control-systems

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/news-events/ics-alerts/ics-alert-10-301-01

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf

    Reference

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.