https://vulnogram.org/ Most recent CVEs assigned by S21sec Cyber Solutions by Thales (s21sec). https://vulnogram.org/seaview/icons/s21sec.png https://vulnogram.org/ Wed, 21 Oct 2026 07:00:07 GMT https://vulnogram.org/CVE-2026-22539 https://vulnogram.org/CVE-2026-22539 As the service interaction is performed without authentication, an attacker with some knowledge of the protocol could obtain information about the charger via OCPP v1.6. Medium Wed, 07 Jan 2026 17:12:01 GMT https://vulnogram.org/CVE-2026-22537 https://vulnogram.org/CVE-2026-22537 The lack of hardening of the system allows the user used to manage and maintain the charger to consult different files containing clear-text credentials or valuable information for an attacker. Medium Wed, 07 Jan 2026 17:05:41 GMT https://vulnogram.org/CVE-2026-22536 https://vulnogram.org/CVE-2026-22536 The absence of permissions control for the user XXX allows the current configuration in the sudoers file to escalate privileges without any restrictions High Wed, 07 Jan 2026 16:47:13 GMT https://vulnogram.org/CVE-2026-22535 https://vulnogram.org/CVE-2026-22535 An attacker with the ability to interact through the network and with access credentials, could, thanks to the unsecured (unencrypted) MQTT communications protocol, write on the server topics of the board that controls the MQTT communications High Wed, 07 Jan 2026 16:37:18 GMT https://vulnogram.org/CVE-2026-22544 https://vulnogram.org/CVE-2026-22544 An attacker with a network connection could detect credentials in clear text. High Network Exploitable Wed, 07 Jan 2026 16:23:08 GMT https://vulnogram.org/CVE-2026-22543 https://vulnogram.org/CVE-2026-22543 The credentials required to access the device's web server are sent in base64 within the HTTP headers. Since base64 is not considered a strong cipher, an attacker could intercept the web request handling the login and obtain the credentials Medium Wed, 07 Jan 2026 16:10:57 GMT https://vulnogram.org/CVE-2026-22542 https://vulnogram.org/CVE-2026-22542 An attacker with access to the system's internal network can cause a denial of service on the system by making two concurrent connections through the Telnet service. Critical Network Exploitable Wed, 07 Jan 2026 15:24:04 GMT https://vulnogram.org/CVE-2026-22541 https://vulnogram.org/CVE-2026-22541 The massive sending of ICMP requests causes a denial of service on one of the boards from the EVCharger that allows control the EV interfaces. Since the board must be operating correctly for the charger to also function correctly. High Network Exploitable Wed, 07 Jan 2026 15:12:42 GMT https://vulnogram.org/CVE-2026-22540 https://vulnogram.org/CVE-2026-22540 The massive sending of ARP requests causes a denial of service on one board of the charger that allows control of the EV interfaces. Since the board must be operating correctly for the charger to also function correctly. Critical Network Exploitable Wed, 07 Jan 2026 14:16:32 GMT https://vulnogram.org/CVE-2025-64385 https://vulnogram.org/CVE-2025-64385 The equipment initially can be configured using the manufacturer's application, by Wi-Fi, by the web server or with the manufacturer’s software. Using the manufacturer's software, the device can be configured via UDP. Analyzing this communication, it… Critical Network Exploitable Fri, 31 Oct 2025 14:23:06 GMT https://vulnogram.org/CVE-2025-64389 https://vulnogram.org/CVE-2025-64389 The web server of the device performs exchanges of sensitive information in clear text through an insecure protocol. High Network Exploitable Fri, 31 Oct 2025 14:19:48 GMT https://vulnogram.org/CVE-2025-64388 https://vulnogram.org/CVE-2025-64388 Denial of service of the web server through specific requests to this protocol Critical Network Exploitable Fri, 31 Oct 2025 14:17:00 GMT https://vulnogram.org/CVE-2025-64387 https://vulnogram.org/CVE-2025-64387 The web application is vulnerable to a so-called ‘clickjacking’ attack. In this type of attack, the vulnerable page is inserted into a page controlled by the attacker in order to deceive the victim. This deception can range from making the victim cli… Medium Network Exploitable Fri, 31 Oct 2025 14:12:55 GMT https://vulnogram.org/CVE-2025-64386 https://vulnogram.org/CVE-2025-64386 The equipment grants a JWT token for each connection in the timeline, but during an active valid session, a hijacking of the token can be done. This will allow an attacker with the token modify parameters of security, access or even steal the session… High Network Exploitable Fri, 31 Oct 2025 13:42:32 GMT https://vulnogram.org/CVE-2025-11155 https://vulnogram.org/CVE-2025-11155 The credentials required to access the device's web server are sent in base64 within the HTTP headers. Since base64 is not considered a strong cipher, an attacker could intercept the web request handling the login and obtain the credentials. Medium Mon, 29 Sep 2025 15:14:39 GMT