CHARX SEC CVE-2026-44102

The OCPP backend port must be reachable by the attacker over the network; the CVSS PR:N confirms no authentication is required to trigger the firmware download. Exploitation further requires winning a race condition during the cleanup process - the attacker must interact with the downloaded file within a brief, implementation-defined window between download completion and file deletion, introducing practical timing difficulty. Factors that limit exploitation: (1) the race window duration is short and unspecified, requiring precise or repeated timing attempts; (2) in secure deployments, OCPP backends are already restricted to internal charging network infrastructure and not exposed to untrusted networks; (3) the confirmed impact is low integrity only - no confidentiality or availability impact is established by the CVSS vector. Deployments that expose the OCPP backend to external or shared network segments without additional access controls represent the highest-risk posture.

The CVSS 4.0 base score of 6.9 with AV:N/AC:L/AT:N/PR:N/UI:N reflects a network-accessible, unauthenticated attack path with low complexity - but the sole confirmed impact is low integrity (VI:L) with no confidentiality (VC:N) or availability (VA:N) consequence. The CWE-362 race condition introduces practical exploitation difficulty: winning the cleanup window requires precise timing that limits reliable, automated exploitation despite the AC:L rating in the provided 4.0 vector. A notable discrepancy exists between the 'Information Disclosure' tag and the CVSS VC:N metric - the tag implies some readable data exposure during the race window, but the vector confirms no confidentiality impact; this should be verified against the CERT VDE advisory VDE-2026-008. No EPSS score was provided. The absence of any CISA KEV entry and no identified public exploit code together suggest this has not been observed in active exploitation campaigns. For EV charging infrastructure operators, the primary concern is the unauthenticated network vector rather than the low immediate impact, particularly in deployments where OCPP backends face external network segments.

An unauthenticated attacker with network access to a CHARX SEC device's OCPP backend crafts a firmware update request referencing an invalid firmware payload and submits it to the device. The device downloads the invalid file and begins its cleanup routine; the attacker races to access or interact with the temporarily resident file during the brief period before the cleanup lock should - but fails to - prevent access. No public proof-of-concept code has been identified, and successful exploitation requires winning a narrow, implementation-defined timing window.