CVE-2026-22100 | THREATINT

Description

The OCPP DataTransfer message `ReserveLogin` is vulnerable to command injection. By manipulating the data value, arbitrary OS commands can be executed as root.

PUBLISHED Reserved 2026-01-06 | Published 2026-07-13 | Updated 2026-07-13 | Assigner DIVD

HIGH: 8.6CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Problem types

CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

Product status

Default status

unaffected

Any version before 1.5.1

affected

Credits

Wilco van Beijnum (ElaadNL) finder

Jeroen van der Ham-de Vos (DIVD) analyst

References

csirt.divd.nl/DIVD-2026-00001/ third-party-advisory

cve.org (CVE-2026-22100)

nvd.nist.gov (CVE-2026-22100)

Download JSON