CVE-2026-22539 INFORMATION DISCLOSURE VIA CURL REQUESTS (OCPP)
Unauthenticated attackers can obtain charger information via OCPP protocol requests due to missing authentication in service interactions.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-22539?
CVE-2026-22539 is a medium-severity vulnerability in EFACEC QC 60/90/120, published on 7 Jan 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
As the service interaction is performed without authentication, an attacker with some knowledge of the protocol could obtain information about the charger via OCPP v1.6.
Weakness: CWE-201
Which versions are affected by CVE-2026-22539?
How do I fix CVE-2026-22539?
No fix has been published for CVE-2026-22539 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-22539 being exploited?
There is no known exploitation of CVE-2026-22539 in the wild and no public exploit code.
Sources
Also known as GHSA-5c9g-c5m4-vmrj.