CVE-2026-22110High· 8.7▾ TwilightThe web server does not check authentication on POST or PUT. An unauthenticated attacker can reboot the charger; by brute-forcing the configid, they can also set the service password and then change any setting.
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 47.8 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake. The CVSS score shown above comes from the assigning CNA record, not NVD.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
0.2%
The web server does not check authentication on POST or PUT. An unauthenticated attacker can reboot the charger; by brute-forcing the configid, they can also set the service password and then change any setting.
msi-image < 2.4.18ECP < 4.4.1Update to the latest version.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-22109High· 8.4Default WebUI passwords stored in plaintext
CVE-2026-22105High· 8.7Use of default password based on serial number
CVE-2026-22114Medium· 5.3Missing brute-force protection for web interface
CVE-2025-61777Critical· 9.4Flag Forge is a Capture The Flag (CTF) platform
CVE-2025-14567Medium· 5.3A weakness has been identified in haxxorsid Stock-Management-System up to fbbbf213e9c93b87183a3891f77e3cc7095f22b0
CVE-2025-9815High· 7.8A weakness has been identified in alaneuler batteryKid up to 2.1 on macOS