EUVD-2026-32897
GHSA-x43w-f99f-mhc7
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain low-tier Amtron credential
-
DeliveryAuthenticate to web interface
-
ExploitSend crafted POST to password-change endpoint
-
ExecutionReset admin/manufacturer password
-
PersistLog in as operator
-
ImpactReconfigure charger or pivot to backend
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V8 - Authorization Least privilege enforcement
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Attacker must hold valid credentials for any low-privileged account on the Amtron web interface and have network reachability to that interface (typically the charger's LAN, operator VPN, or - if misconfigured - the public internet). The target firmware must be 5.22.3 or earlier. No user interaction from the admin is required; the attack works against default role configurations because the privilege check is absent at the password-change endpoint rather than being toggled by a setting. Note: the CVSS vector states PR:N but the description requires authentication, so realistic exploitation is gated by possession of a low-tier account - verify the authoritative privilege requirement with the CyberDanube advisory. |
| Impact | Signals are partially conflicting and warrant scrutiny. The CVSS 4.0 vector advertises PR:N (no privileges required), yet the description explicitly requires an authenticated low-privileged user - the vector appears inconsistent with the narrative and the realistic prerequisite is at least PR:L. With that caveat, AV:N/AC:L/AT:N/UI:N plus E:P (proof-of-concept maturity) and full VC:H/VI:H/VA:H impact, with subsequent-system impact also high (SC:H/SI:H/SA:H), makes this a high-priority issue for any operator running Amtron units reachable from a routable network or sharing credentials with field technicians. EPSS data and KEV listing are absent at time of analysis, so widespread automated exploitation is not yet evidenced; however, EV charging infrastructure is increasingly targeted, and the trivial nature of the attack (a crafted POST after any low-tier login) means risk is real wherever low-tier accounts are widely provisioned. |
| Exploit ScenarioDerived | An attacker who has obtained or been issued any low-tier web account on the charger - for example a guest or service-tech credential, or one harvested from a previous breach - logs in over the network and sends a crafted POST request to the password-change endpoint specifying the admin or manufacturer account as the target. Because proof-of-concept exploit code exists per CyberDanube, the attacker reliably resets the operator password, logs in as admin, and can then alter charging policy, exfiltrate billing/RFID data, brick the unit, or pivot into the operator's backend. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – May 28, 2026
Privilege escalation in Mennekes Amtron EV charging stations (firmware ≤ 5.22.3) allows a low-privileged authenticated user to overwrite credentials for the admin (operator) and manufacturer accounts through crafted POST requests, effectively granting full takeover of the charger's management interface. Publicly available exploit code exists per the CyberDanube research advisory, and the CVSS 4.0 base score of 9.3 reflects high impact across confidentiality, integrity, and availability with cascading effects on subsequent systems. Not currently listed in CISA KEV.
RemediationAI
No vendor-released patch identified at time of analysis; the only public reference is the CyberDanube research write-up at https://cyberdanube.com/security-research/multiple-vulnerabilities-in-mennekes-amtron-series/, which operators should monitor alongside Mennekes' own advisories for a firmware build above 5.22.3. Until a fix is published, compensating controls include removing the charger's management interface from any internet-routable network and placing it behind a VPN or jump host, restricting issuance of low-privileged web accounts to a minimum trusted set and rotating their credentials, and monitoring HTTP POST traffic to password-change endpoints for anomalous source accounts (trade-off: network restrictions may complicate remote operator workflows and OCPP-related troubleshooting). Disabling or removing the low-privileged role entirely is the strongest mitigation but will break any operational workflow that depends on it.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The Mennekes Amtron series is a family of networked AC wallbox EV chargers that expose a web-based management interface for operators (administrators) and the manufacturer. The flaw is classified as CWE-269 (Improper Privilege Management), meaning the password-change endpoint fails to enforce that the requester possesses sufficient privilege over the target account; instead, any authenticated session can submit a POST request that rewrites the admin or manufacturer password. This is a classic horizontal/vertical privilege boundary failure in the authorization layer rather than an authentication bypass - the application authenticates the caller but does not verify the caller's role against the privilege level of the account being modified.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P
Primary rating from Vendor (cyberdanube) · only source for this CVE.
CVSS VectorVendor: cyberdanube
DescriptionCVE.org
The Mennekes Amtron series (firmware versions ≤ 5.22.3) is vulnerable to privilege escalation. An authenticated low-privileged user can change the passwords of the admin (operator) and manufacturer accounts via crafted POST requests.
Executive ViewAI
Mennekes Amtron EV charging stations (firmware ≤5.22.3) contain a critical privilege escalation vulnerability enabling any authenticated user to seize full administrative control over charger operations and management credentials. Publicly available exploit code exists. Organizations operating these chargers face immediate operational disruption, billing system compromise, and cascading risk to dependent grid management infrastructure.
Implement strict network segmentation isolating charging infrastructure from all untrusted networks; restrict management access to dedicated administrator subnets requiring VPN and multi-factor authentication; deploy network monitoring and alerting for unauthorized administrative account activity; audit recent admin logs for evidence of compromise; disable internet-accessible remote management features; consider temporary decommissioning of chargers that cannot be adequately isolated until patch becomes available.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.
Exploit-DB