CVE-2026-44100

This is CVE-2026-44100, a critical-severity flaw in CHARX JupiCore charging infrastructure management. An unauthenticated attacker can reach the configuration interface directly and perform three distinct actions: reconfigure charging points (controlling physical energy delivery), disclose device UIDs (enumeration for further attacks), and manipulate files on the system. The CVSS 9.4 reflects this breadth of impact from a single access vector. The vulnerability isn't a bypass or broken authentication — there's simply no authentication at all on this service. The development team assumed network isolation would protect it, which is a common and dangerous pattern in industrial IoT. The charging infrastructure sits at grid-interactive endpoints, interfacing with energy management systems. That means unauthenticated configuration access isn't just 'changing some settings' — it's controlling physical infrastructure that balances grid load. For your environment: audit for configuration management services on OT networks that were deployed without auth under the assumption of network segmentation. Look particularly for legacy or inherited services that may have escaped recent security reviews — these 'forgotten layers' are where this class of vulnerability lives. The CHARX case isn't isolated: Siemens, Schneider Electric, and other industrial vendors have shipped the same pattern in energy sector products since 2014. Each disclosure teaches attackers that charging management interfaces are a viable entry point, regardless of whether CHARX specifically is exploitable in your deployment. Ignore the EPSS score of 0.00277. Low exploitability scores for niche industrial protocols reflect where scanners can reach, not where sophisticated actors actually operate. State-sponsored and criminal groups targeting energy infrastructure have the network access and patience to find these services. The CVE itself is now reconnaissance intelligence in their hands — they know the charging infrastructure supply chain almost certainly contains other vendors with similar unauthenticated configuration surfaces.

Reviewed through automated stages and approved by a human before publication.