CVE-2026-22110: Missing authentication check on POST/PUT requests
Published Oct 30, 2026
·Updated
The web server does not check authentication on POST or PUT. An unauthenticated attacker can reboot the charger; by brute-forcing the configid, they can also set the service password and then change any setting.
Event History
Oct 30, 2026
CVE Published
via MITRE·10:34 AM
Data Sourced
via MITRE·10:34 AM
RemedyDescriptionWeakness
Data Sourced
via NVD·11:17 AM
DescriptionSeverityWeakness
Frequently Asked Questions
1
What access does an attacker need to exploit this issue?
An attacker does not need to authenticate. Exploitation requires the ability to send POST or PUT requests to the affected web server.
2
What can an unauthenticated attacker do?
An unauthenticated attacker can reboot the charger. If they successfully brute-force the configid, they can set the service password and change any setting.
3
Does exploitation require brute-forcing the configid?
No. Rebooting the charger does not require brute-forcing the configid. Brute-forcing is needed to set the service password and then modify any setting.