CVE-2026-22110

8.7 high

The web server does not check authentication on POST or PUT. An unauthenticated attacker can reboot the charger; by brute-forcing the configid, they can also set the service password and then change any setting.

Severity

CVSS 4.0

8.7 high

CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N

CWE: CWE-306
Published: 2026-10-30
Modified: 2026-10-30
Record from: the NVD, synced 2026-10-30

References

https://csirt.divd.nl/CVE-2026-22110
https://csirt.divd.nl/DIVD-2026-00012

Check your stack JSON