CHARX SEC CVE-2026-44091

Exploitation requires network reachability to the CHARX SEC controller's MQTT broker interface; the attacker POSTs a malicious ID which is accepted and written as a new system configuration entry. Per the CVSS vector (AV:N/AC:L/AT:N/PR:N/UI:N), no authentication, no user interaction, and no special attack requirements are needed against affected firmware (1.0.0 through 1.9.0). The primary limiting factor is exposure of the MQTT broker: if the broker is segmented on an isolated OT network and not reachable from untrusted hosts, remote exploitation is prevented; only devices whose broker port is accessible to the attacker are at risk.

The supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N, VC:N/VI:H/VA:H) describes a network-reachable, low-complexity, unauthenticated attack with high integrity and availability impact but no confidentiality impact, scoring 8.8 (High) - consistent with the description of configuration tampering rather than data theft. Note a labeling inconsistency: the intelligence tag reads 'Information Disclosure,' yet both the CVSS vector (VC:N) and the description indicate integrity/availability impact, not confidentiality, so the tag appears mislabeled and should be treated with caution. There is no EPSS score, no KEV listing, and no POC in the provided data, so real-world exploitation pressure cannot be quantified; however, the combination of no authentication, network vector, and a vendor-confirmed patch makes this a genuine priority for exposed devices, since exploitation depends only on network reachability of the MQTT broker.

An attacker with network access to a CHARX SEC controller's MQTT broker sends a crafted message containing a malicious ID, which the device accepts without authentication and writes as a new system configuration entry, corrupting device state and potentially disrupting charging availability. Because the CVSS vector is AV:N/AC:L/PR:N/UI:N, this needs only reachability to the broker and no credentials, user interaction, or complex preconditions. No public POC is identified at this time.