CVE-2026-44104
A critical flaw in the firmware update process of a charging controller’s basemodule allows attackers to install tampered firmware because only a CRC32 checksum is checked, not a cryptographic signature.
No official fix yet. If none appears within 45 days of first tracking, this entry is removed automatically.
Who is affected
Charging controllers that use the basemodule firmware update process described, though no specific product versions are listed.
Real-world impact
An attacker who can push a firmware update can gain full control of the device, potentially enabling remote takeover, data theft, or sabotage of the charging system.
Why this severity
The CVSS score of 9.3 reflects that the vulnerability is exploitable remotely without authentication, provides complete system compromise, and has no mitigations in place, making it a critical risk.
What to do about it
- ›Avoid installing firmware updates from untrusted or unknown sources.
- ›If possible, manually verify the firmware’s integrity before installation.
- ›Contact the vendor to obtain firmware signed with a cryptographic signature or a patch that adds signature verification.
No official fix or mitigation is documented in the sources yet. Monitor the vendor advisory and apply the patch as soon as it is released.
No fix documented in sources