CVE-2026-22110

UNKNOWN

Published 2026-10-30 · Source csirt@divd.nl

Description

The web server does not check authentication on POST or PUT. An unauthenticated attacker can reboot the charger; by brute-forcing the configid, they can also set the service password and then change any setting.

CWE-306

References

View on NVD

Related CVEs

Same severity, most recent

CVE-2026-110972
Płatnik performs client-side authentication. An attacker with access to any application instance connected to the backend server can bypass the login verification process and authenticate as an arbitrary user. This issue was fixed in metric 242 in version 10.02.002.
2026-10-30 · score —
CVE-2026-110971
Use of a weak password encoding algorithm in Płatnik software allows a user who obtains encoded password to easily decode it. This issue was fixed in metric 242 in version 10.02.002.
2026-10-30 · score —
CVE-2026-110970
Płatnik uses HTTP protocol to download updates, libraries and support files. It allows an attacker to conduct a Man-In-The-Middle attack, obtain transmitted data and replace the original files with their own. This issue was fixed in metric 242 in version 10.02.002.
2026-10-30 · score —
CVE-2026-105924
A NULL pointer dereference vulnerability in the Qt QCborValue to JSON conversion of the Qt Core module.
2026-10-30 · score —
CVE-2025-68395
ARKETEAM Protectel modules PROTECTELMAJ and BDF contain a note editor module vulnerable to Stored XSS. A low privileged attacker can inject arbitrary HTML and JS into notes, which will be rendered/executed when a user visits this module. This issue has been fixed in: PROTECTELMAJ v6.5.19 and BDF v6.4.67
2026-10-30 · score —