CVE-2026-22099

HighCVSS 8.7

Published: 13/07/2026(UTC)Updated: 13/07/2026(UTC)Translated: 14/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.25%

16th percentile - higher than 16% of all known CVEs

Summary

The charging station does not require authentication for Bluetooth commands, allowing unauthorized devices to perform actions. The vulnerability enables sensitive information leakage, triggering reboots, or pushing a firmware update URL.

Risk Assessment

An attacker within Bluetooth range can take control of the charging station, leading to data confidentiality breaches, service disruptions, or installation of malicious firmware.

Recommendation

Implement authentication for all Bluetooth commands and limit transmission range. Also update the charging station firmware to the latest version.

Other vulnerabilities in ChargingStation

CVE-2026-20744Critical
The charging station websocket endpoint accepts connections without proper authentication, which could lead to privilege escalation.

Original NVD description (English source)

The charging station does not require authentication for Bluetooth commands to perform actions. The functionality exposed includes sensitive information leakage, triggering reboots, or pushing a firmware update URL.