CHARX SEC CVE-2026-44103

Exploitation requires only network-level reachability to the JupiCore firmware update service on an affected CHARX SEC device running firmware 1.0.0 through 1.9.0. No authentication, privileged account, non-default configuration, or user interaction is required - the JupiCore service accepts firmware payloads from any reachable source without credential challenges or integrity checks. Exploitation is bounded by the device's network exposure: units deployed on isolated OT/charging-network segments or behind firewalls blocking external access to the management interface are substantially harder to reach. The direct impact is limited to integrity of the internal charging module; confidentiality is not affected per available data. The PR:N and UI:N CVSS metrics confirm no access prerequisites beyond network reachability.

The CVSS 4.0 base vector (AV:N/AC:L/AT:N/PR:N/UI:N) places this at maximum exploitability: network-reachable, no authentication, no complexity, and no user interaction required. The base score of 6.9 is driven primarily by the scoped-down impact rating (VI:L, all other impact metrics N), which appears conservative given that successful exploitation allows full replacement of the charging module's firmware - a high-integrity impact scenario. The CVSS 4.0 score likely understates real-world risk in safety-critical OT/ICS environments where firmware tampering can result in persistent backdoors, altered charging behavior, or physical safety risks. No EPSS data is available and no CISA KEV listing exists, indicating no confirmed widespread exploitation at time of analysis. The chaining potential with CVE-2026-44104, flagged in the description, elevates priority for defenders managing CHARX SEC deployments. For OT/ICS-adjacent environments, this should be treated as higher priority than the 6.9 score suggests.

An attacker with network access to a CHARX SEC controller crafts a malicious firmware image and submits it to the JupiCore firmware update endpoint without any credentials. JupiCore accepts the payload and transmits it directly to the internal charging module without performing signature or hash verification, resulting in the malicious firmware being flashed to the module. The attacker's firmware persists across reboots, potentially backdooring the device for sustained access or enabling a follow-on attack via CVE-2026-44104.