CVE Intelligence

EFACEC vulnerabilities

🔔 Create alert RSS

Published CVEs affecting EFACEC products: 9 record(s), with severity, exploitation and fixes.

QC60/90/120 9

Exploited only (KEV) →

CVE-2026-22539 Medium · 5.3 CWE-201 Jan 7, 2026
INFORMATION DISCLOSURE VIA CURL REQUESTS (OCPP)
As the service interaction is performed without authentication, an attacker with some knowledge of the protocol could obtain information about the charger via OCPP v1.6.
CVE-2026-22544 High · 8.7 CWE-319 Jan 7, 2026
EXCHANGE OF CREDENTIALS IN CLEAR TEXT
An attacker with a network connection could detect credentials in clear text.
CVE-2026-22543 Medium · 6.9 CWE-261 Jan 7, 2026
WEEK ENCODING FOR PASSWORDS
The credentials required to access the device's web server are sent in base64 within the HTTP headers. Since base64 is not considered a strong cipher, an attacker could intercept the web request handling the login and obtain the credentials
CVE-2026-22537 Medium · 6.8 CWE-497 Jan 7, 2026
INFORMATION DISCLOSURE WITHIN THE OPERATING SYSTEM
The lack of hardening of the system allows the user used to manage and maintain the charger to consult different files containing clear-text credentials or valuable information for an attacker.
CVE-2026-22536 High · 8.6 CWE-269 Jan 7, 2026
PRIVILEGE ESCALATION VIA SUDO COMMAND
The absence of permissions control for the user XXX allows the current configuration in the sudoers file to escalate privileges without any restrictions
CVE-2026-22535 High · 8.9 CWE-1366 Jan 7, 2026
FRAIL SECURITY IN MQTT PROTOCOL ALLOWS AN ATTACKER MODIFY CRITICAL PARAMETERS
An attacker with the ability to interact through the network and with access credentials, could, thanks to the unsecured (unencrypted) MQTT communications protocol, write on the server topics of the board that controls the MQTT communications
CVE-2026-22542 Critical · 9.2 CWE-400 Jan 7, 2026
DENIAL OF SERVICE FOR CONCURRENT CONNECTIONS ON TELNET
An attacker with access to the system's internal network can cause a denial of service on the system by making two concurrent connections through the Telnet service.
CVE-2026-22541 High · 8.2 CWE-400 Jan 7, 2026
DENIAL OF SERVICE VIA ICMP PACKETS
The massive sending of ICMP requests causes a denial of service on one of the boards from the EVCharger that allows control the EV interfaces. Since the board must be operating correctly for the charger to also function correctly.
CVE-2026-22540 Critical · 9.2 CWE-400 Jan 7, 2026
DENIAL OF SERVICE VIA ARP PACKETS
The massive sending of ARP requests causes a denial of service on one board of the charger that allows control of the EV interfaces. Since the board must be operating correctly for the charger to also function correctly.