Vulnerability · Published Jan 7, 2026 · Assigned by S21sec
CVE-2026-22539INFORMATION DISCLOSURE VIA CURL REQUESTS (OCPP)
Medium 5.3
In plain English
A medium-severity security flaw in QC 60/90/120 from EFACEC. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 16% of all known vulnerabilities).
Severity (CVSS 4.0)5.3Medium
Exploit odds (30 days)0.2%top 83.9% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
As the service interaction is performed without authentication, an attacker with some knowledge of the protocol could obtain information about the charger via OCPP v1.6.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| EFACEC | QC 60/90/120 | 8 |
Weakness: CWE-201 · Vector: CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N