CVE-2026-44383

HighCVSS 7.5

Published: 10/07/2026(UTC)Updated: 13/07/2026(UTC)Translated: 14/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.56%

43th percentile - higher than 43% of all known CVEs

Summary

Multiple connections to the backend using the same charging station ID are allowed, which could allow an attacker to deploy multiple instances of malicious OCPP clients to overwhelm the backend.

Risk Assessment

The organization is at risk of a Denial of Service (DoS) attack on the EV charging backend, potentially disrupting charging station operations and affecting service availability.

Recommendation

Implement a mechanism to limit concurrent connections per charging station ID and deploy OCPP traffic monitoring to detect anomalies.

Other vulnerabilities in OCPP

CVE-2026-22100High
The OCPP DataTransfer message `ReserveLogin` is vulnerable to command injection. Manipulating the data value allows arbitrary OS commands to be executed as root.

Original NVD description (English source)

Multiple connections to the backend using the same charging station ID are allowed, which could allow an attacker to deploy multiple instances of malicious OCPP clients to overwhelm the backend.