BaseFortify

Publication date: 2026-01-07

Last updated on: 2026-01-08

Assigner: S21sec

Description

As the service interaction is performed without authentication, an attacker with some knowledge of the protocol could obtain information about the charger via OCPP v1.6.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-01-07

Last Modified

2026-01-08

Generated

2026-07-06

AI Q&A

2026-01-07

EPSS Evaluated

2026-07-05

NVD

CVE-2026-22539

Affected Vendors & Products

Vendor	Product	Version / Range
thales	ocpp	1.6

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-201	The code transmits data to another actor, but a portion of the data includes sensitive information that should not be accessible to that actor.

Attack-Flow Graph

Executive Summary

This vulnerability occurs because the service interaction is performed without authentication, allowing an attacker who has some knowledge of the protocol to obtain information about the charger via OCPP v1.6.

Impact Analysis

An attacker could gain unauthorized information about the charger, which may lead to information disclosure and potential misuse of the charger or related systems.

Hi! I’m here to help you understand CVE-2026-22539. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70