CVE-2026-22110
HighCVSS 8.7Exploitation Probability (EPSS)
Low risk15th percentile - higher than 15% of all known CVEs
Summary
The web server does not check authentication on POST or PUT. An unauthenticated attacker can reboot the charger; by brute-forcing the configid, they can also set the service password and then change any setting.
Risk Assessment
Lack of authentication control enables unauthorized configuration changes and disruption of the charger, potentially affecting charging service availability.
Recommendation
Restrict network access to the charger's web interface and apply the vendor fix that enforces authentication on POST/PUT requests.
Other vulnerabilities in WebUI
See all- CVE-2016-8494High
Insufficient verification of uploaded files allows attackers with webui administrators privileges to perform arbitrary code execution by uploading a new webui theme.
- CVE-2026-22109High
The shipped WebUI template database retains the factory default passwords for all five account types in cleartext. Defaults are identical across devices and were unchanged on the tested unit.
- CVE-2025-41692Medium
A high privileged remote attacker with admin privileges for the webUI can brute-force the "root" and "user" passwords of the underlying OS due to a weak password generation algorithm.
Original NVD description (English source)
The web server does not check authentication on POST or PUT. An unauthenticated attacker can reboot the charger; by brute-forcing the configid, they can also set the service password and then change any setting.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS