CVE-2026-44094
HighCVSS 8.6Exploitation Probability (EPSS)
Low risk18th percentile - higher than 18% of all known CVEs
Summary
An unauthenticated remote attacker can force the system to fall back to a firmware partition with an insecure configuration including default credentials. This could allow the attacker to gain SSH access to the system as an unprivileged user "user-app". Charging could be interrupted.
Risk Assessment
Risk of unauthorized system access and potential interruption of charging processes, leading to service disruption.
Recommendation
Update the firmware to a version that fixes this vulnerability and ensure default credentials are changed.
Other vulnerabilities in Firmware
See all- CVE-2026-35075Critical
An unauthenticated remote attacker can recover a default, hard-coded password from a firmware image and gain full access to all affected devices.
- CVE-2026-9650High
CWE-522 Insufficiently Protected Credentials vulnerability allows an unauthenticated attacker to access credentials stored in firmware or system files. This can lead to unauthorized access and exposure of sensitive information, and with physical access to the device, full compromise.
Original NVD description (English source)
An unauthenticated remote attacker can enforce the system to fall back to a firmware partition with an insecure configuration including default credentials. This could allow the attacker to gain SSH access to the system as an unprivileged user "user-app". Charging could be interrupted.