CVE-2026-44105
MediumCVSS 6.6Exploitation Probability (EPSS)
Low risk1th percentile - higher than 1% of all known CVEs
Summary
The credentials for the local user "user-app" may be exposed in log files, potentially enabling a low-privileged local attacker with access to the logs to authenticate via SSH as the limited user "user-app". Charging could be interrupted.
Risk Assessment
Exposure of credentials in logs allows an attacker to access the system as user "user-app", potentially disrupting charging services and escalating the attack.
Recommendation
Remove credentials from logs, store them in a secure vault, and restrict log file access to authorized administrators only.
Other vulnerabilities in JupiCore
See all- CVE-2026-44103Medium
An unauthenticated remote attacker can inject malicious firmware into the internal charging module because the JupiCore service transmits firmware updates without performing integrity or verification check. Successful exploitation may compromise the integrity of the affected device. This vulnerability could be used in chain with CVE-2026-44104.
- CVE-2026-44102Medium
An unauthenticated remote attacker can trigger a firmware update download via the OCPP backend by supplying an invalid firmware file. This will cause the file to remain accessible for a short period before it is deleted due to improper locking during the cleanup process.
Original NVD description (English source)
The credentials for the local user "user-app" may be exposed in log files, potentially enabling a low-privileged local attacker with access to the logs to authenticate via SSH as the limited user "user-app". Charging could be interrupted.