CVE-2021-45876: Garo Wallbox Glb Firmware

Critical severity, CVSS 9.8. EPSS: 1.5% chance of exploitation in the next 30 days.

Multiple versions of GARO Wallbox GLB/GTB/GTC are affected by unauthenticated command injection. The url parameter of the function module downloadAndUpdate is vulnerable to an command Injection. Unfiltered user input is used to generate code which then gets executed when downloading new firmware.

Affected products

• Garo Wallbox Glb Firmware: up to and including 185
• Garo Wallbox Gtb Firmware: up to and including 185
• Garo Wallbox Gtc Firmware: up to and including 185

Published 2022-03-21. Last modified 2026-06-17.