TI-2026-17769 CVE-2026-22103 · GHSA-6f5q-g982-5373
Command injection in NPC start web endpoint
Priority MEDIUM 51
The NPC start endpoint on the web server at port 8090 is vulnerable to command injection.
Vulnerabilities
7 records
TI-2026-17764 CVE-2026-22098 · GHSA-86f2-h28h-r4fm
Sensitive information is written to logs
Priority MEDIUM 46
Various sensitive information such as passwords and charging card UIDs are written to log files.
TI-2026-17763 CVE-2026-22097 · GHSA-fmp2-hp5c-w25p
Missing firmware validation allows remote code execution
Priority MEDIUM 48
The firmware update mechanism does not include cryptographic signature validation.
TI-2026-17768 CVE-2026-22102 · GHSA-7jrx-8jxh-496c
Arbitrary file overwrite through certificate update functionality
Priority MEDIUM 49
A POST request sent to a specific webserver endpoint can be used to write to arbitrary file locations.
TI-2026-17762 CVE-2026-22096 · GHSA-56jh-x7v6-jq26
Missing authentication for webserver endpoints
Priority MEDIUM 49
The webserver running on port 8090 does not require authentication.
TI-2026-17766 CVE-2026-22100 · GHSA-28mc-whm7-9h23
Comnand injection in OCPP ReserveLogin message
Priority MEDIUM 41
The OCPP DataTransfer message `ReserveLogin` is vulnerable to command injection.
TI-2026-17761 CVE-2026-22095 · GHSA-644p-7q3w-636g
Command injection in diagnosis web endpoint
Priority MEDIUM 51
The network diagnosis endpoint on the web server at port 8090 is vulnerable to command injection.