Skip to content
OpenAdvisories
Medium · 5.3 CVE-2026-22539 EUVD-2026-1191GHSA-5c9g-c5m4-vmrj

INFORMATION DISCLOSURE VIA CURL REQUESTS (OCPP)

Published Jan 7, 2026 · Updated Jan 9, 2026 · Assigned by S21sec

Description

As the service interaction is performed without authentication, an attacker with some knowledge of the protocol could obtain information about the charger via OCPP v1.6.

Affected products

VendorProductAffectedFixed
EFACEC QC 60/90/120 8 —

References