CVE-2026-44101
The CHARX OCPP Agent service lacks authentication, allowing anyone on the network to reconfigure its backend connection. This can cause denial of service and expose confidential data. The vulnerability is rated critical due to its high impact and ease of exploitation.
No official fix yet. If none appears within 45 days of first tracking, this entry is removed automatically.
Who is affected
CHARX OCPP Agent service, typically used in electric vehicle charging infrastructure.
Real-world impact
An attacker could reconfigure the backend connection, causing the service to stop working (Denial of Service) and potentially expose confidential data to the attacker.
Why this severity
The CVSS score of 9.3 reflects the lack of authentication (making it trivial to exploit), the high confidentiality, integrity, and availability impact, and the fact that the attacker can do so remotely without any user interaction.
What to do about it
- ›Restrict network access to the CHARX OCPP Agent service to trusted hosts only.
- ›Disable the service if it is not required.
No official fix or mitigation is documented in the sources yet. Monitor the vendor advisory and apply the patch as soon as it is released.
No fix documented in sources