CVE-2026-22099 Overview
CVE-2026-22099 describes a missing authentication flaw in a charging station's Bluetooth control interface. An attacker within Bluetooth range can issue commands without presenting credentials. The exposed functionality includes leaking sensitive information, triggering reboots, and pushing a firmware update URL to the device.
The weakness maps to [CWE-287] Improper Authentication. Because firmware update URLs can be pushed without authentication, an adjacent attacker may steer the station to attacker-controlled firmware. The vulnerability was published to the National Vulnerability Database (NVD) on 2026-07-13.
Critical Impact
An adjacent attacker can extract sensitive data, force reboots, and redirect firmware updates on the charging station without authenticating.
Affected Products
- Charging station firmware exposing an unauthenticated Bluetooth command interface
- Specific vendor and model details are not published in the NVD record
- Refer to the DIVD Security Advisory for coordinated disclosure details
Discovery Timeline
- 2026-07-13 - CVE-2026-22099 published to NVD
- 2026-07-13 - Last updated in NVD database
Technical Details for CVE-2026-22099
Vulnerability Analysis
The charging station accepts Bluetooth commands without validating the identity of the sender. The Bluetooth service exposes operational functions directly to any paired or in-range client. No cryptographic authentication, session token, or challenge-response mechanism gates these commands.
Three command categories are reachable without authentication. First, information disclosure commands return sensitive station data to the caller. Second, a reboot command interrupts service availability on demand. Third, a firmware update command accepts a URL that the station will use to fetch new firmware.
The firmware update path carries the highest downstream risk. If the update process does not additionally verify code signatures at flash time, an attacker can supply a malicious URL and deliver modified firmware. Even where signature verification exists, forcing the station to fetch attacker-controlled content enables reconnaissance and denial-of-service.
Root Cause
The root cause is a design-level omission classified under [CWE-287]. Security-relevant Bluetooth commands were exposed on the wireless attack surface with no requirement for authenticated pairing, per-command authorization, or transport-layer identity binding. Trust is implicitly granted to any Bluetooth peer.
Attack Vector
Exploitation requires only adjacent network access over Bluetooth. The attacker does not need prior privileges or user interaction. Reaching the station within Bluetooth range is sufficient to send crafted commands, request configuration data, force a reboot, or supply a firmware URL. See the DIVD Security Advisory for coordinated disclosure information.
Detection Methods for CVE-2026-22099
Indicators of Compromise
- Unexpected reboots or availability gaps reported by charging station telemetry or backend management systems
- Outbound HTTP or HTTPS requests from the station to unfamiliar hosts consistent with a firmware fetch
- Bluetooth pairing or connection events from unknown device addresses at station locations
- Configuration or diagnostic data appearing in external captures despite no authorized maintenance activity
Detection Strategies
- Log all Bluetooth connection, pairing, and command events on the station and forward them to a central collector
- Alert on any firmware update command that references a URL outside the vendor's approved update infrastructure
- Correlate reboot events with preceding Bluetooth activity to surface remotely triggered restarts
- Baseline normal outbound network destinations from stations and flag deviations
Monitoring Recommendations
- Deploy periodic Bluetooth spectrum surveys near deployed stations to detect unauthorized scanning or command activity
- Ingest station syslog and management-plane events into a SIEM for cross-site correlation
- Track firmware version drift across the fleet to identify stations pointed at unauthorized update sources
How to Mitigate CVE-2026-22099
Immediate Actions Required
- Consult the DIVD Security Advisory to identify affected models and available vendor guidance
- Disable the Bluetooth interface on the charging station where operationally feasible until a patched firmware is available
- Restrict physical access to reduce the number of locations from which an attacker can reach Bluetooth range
- Verify current firmware versions across the fleet and confirm they match vendor-approved builds
Patch Information
No vendor patch reference is included in the NVD record at publication time. Operators should track the DIVD Security Advisory and vendor communications for firmware updates that add authentication to Bluetooth command handling. Apply updates only from vendor-controlled distribution channels.
Workarounds
- Turn off Bluetooth on the station when it is not required for commissioning or maintenance
- Enforce a physical security perimeter that keeps unauthorized users outside typical Bluetooth range
- Block station egress to unapproved domains at the network layer so unauthorized firmware URLs cannot be reached
- Monitor and log all Bluetooth interactions for post-incident forensics until a firmware fix is deployed
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
