S21sec

Latest CVEs · RSS

• CVE-2026-22539 2026-01-07 · CVSS 5.3
  As the service interaction is performed without authentication, an attacker with some knowledge of the protocol could obtain information about the charger via O
• CVE-2026-22537 2026-01-07 · CVSS 6.8
  The lack of hardening of the system allows the user used to manage and maintain the charger to consult different files containing clear-text credentials or valu
• CVE-2026-22536 2026-01-07 · CVSS 8.6
  The absence of permissions control for the user XXX allows the current configuration in the sudoers file to escalate privileges without any restrictions
• CVE-2026-22535 2026-01-07 · CVSS 8.9
  An attacker with the ability to interact through the network and with access credentials, could, thanks to the unsecured (unencrypted) MQTT communications proto
• CVE-2026-22544 2026-01-07 · CVSS 8.7
  An attacker with a network connection could detect credentials in clear text.
• CVE-2026-22543 2026-01-07 · CVSS 6.9
  The credentials required to access the device's web server are sent in base64 within the HTTP headers. Since base64 is not considered a strong cipher, an attack
• CVE-2026-22542 2026-01-07 · CVSS 9.2
  An attacker with access to the system's internal network can cause a denial of service on the system by making two concurrent connections through the Telnet ser
• CVE-2026-22541 2026-01-07 · CVSS 8.2
  The massive sending of ICMP requests causes a denial of service on one of the boards from the EVCharger that allows control the EV interfaces. Since the board m
• CVE-2026-22540 2026-01-07 · CVSS 9.2
  The massive sending of ARP requests causes a denial of service on one board of the charger that allows control of the EV interfaces. Since the board must be ope
• CVE-2025-64385 2025-10-31 · CVSS 9.2
  The equipment initially can be configured using the manufacturer's application, by Wi-Fi, by the web server or with the manufacturer’s software. Using the manuf
• CVE-2025-64389 2025-10-31 · CVSS 8.3
  The web server of the device performs exchanges of sensitive information in clear text through an insecure protocol.
• CVE-2025-64388 2025-10-31 · CVSS 9.2
  Denial of service of the web server through specific requests to this protocol
• CVE-2025-64387 2025-10-31 · CVSS 5.1
  The web application is vulnerable to a so-called ‘clickjacking’ attack. In this type of attack, the vulnerable page is inserted into a page controlled by the at
• CVE-2025-64386 2025-10-31 · CVSS 7.7
  The equipment grants a JWT token for each connection in the timeline, but during an active valid session, a hijacking of the token can be done. This will allow
• CVE-2025-11155 2025-09-29 · CVSS 6.8
  The credentials required to access the device's web server are sent in base64 within the HTTP headers. Since base64 is not considered a strong cipher, an attack