Vulnerabilidades de EFACEC
CVEs publicadas que afetam produtos de EFACEC: 9 registro(s), com severidade, exploração e correções.
CVE-2026-22539
Média · 5.3
CWE-201 07/01/2026
INFORMATION DISCLOSURE VIA CURL REQUESTS (OCPP)
As the service interaction is performed without authentication, an attacker with some knowledge of the protocol could obtain information about the charger via OCPP v1.6.
CVE-2026-22544
Alta · 8.7
CWE-319 07/01/2026
EXCHANGE OF CREDENTIALS IN CLEAR TEXT
An attacker with a network connection could detect credentials in clear text.
CVE-2026-22543
Média · 6.9
CWE-261 07/01/2026
WEEK ENCODING FOR PASSWORDS
The credentials required to access the device's web server are sent in base64 within the HTTP headers. Since base64 is not considered a strong cipher, an attacker could intercept the web request handling the login and obtain the credentials
CVE-2026-22537
Média · 6.8
CWE-497 07/01/2026
INFORMATION DISCLOSURE WITHIN THE OPERATING SYSTEM
The lack of hardening of the system allows the user used to manage and maintain the charger to consult different files containing clear-text credentials or valuable information for an attacker.
CVE-2026-22536
Alta · 8.6
CWE-269 07/01/2026
PRIVILEGE ESCALATION VIA SUDO COMMAND
The absence of permissions control for the user XXX allows the current configuration in the sudoers file to escalate privileges without any restrictions
CVE-2026-22535
Alta · 8.9
CWE-1366 07/01/2026
FRAIL SECURITY IN MQTT PROTOCOL ALLOWS AN ATTACKER MODIFY CRITICAL PARAMETERS
An attacker with the ability to interact through the network and with access credentials, could, thanks to the unsecured (unencrypted) MQTT communications protocol, write on the server topics of the board that controls the MQTT communications
CVE-2026-22542
Crítica · 9.2
CWE-400 07/01/2026
DENIAL OF SERVICE FOR CONCURRENT CONNECTIONS ON TELNET
An attacker with access to the system's internal network can cause a denial of service on the system by making two concurrent connections through the Telnet service.
CVE-2026-22541
Alta · 8.2
CWE-400 07/01/2026
DENIAL OF SERVICE VIA ICMP PACKETS
The massive sending of ICMP requests causes a denial of service on one of the boards from the EVCharger that allows control the EV interfaces. Since the board must be operating correctly for the charger to also function correctly.
CVE-2026-22540
Crítica · 9.2
CWE-400 07/01/2026
DENIAL OF SERVICE VIA ARP PACKETS
The massive sending of ARP requests causes a denial of service on one board of the charger that allows control of the EV interfaces. Since the board must be operating correctly for the charger to also function correctly.