CVE-2026-22100 Overview
CVE-2026-22100 is a command injection vulnerability in the Open Charge Point Protocol (OCPP) DataTransfer message handler. Attackers who manipulate the data value of a ReserveLogin message can execute arbitrary operating system commands as root. The flaw is tracked under [CWE-78] (Improper Neutralization of Special Elements used in an OS Command). The Dutch Institute for Vulnerability Disclosure (DIVD) published advisory DIVD-2026-00001 documenting the issue. Successful exploitation grants full control over the affected electric vehicle charging endpoint, including its OCPP session and underlying host.
Critical Impact
Authenticated attackers can execute arbitrary OS commands as root through the OCPP ReserveLogin DataTransfer message, resulting in complete compromise of the charging station.
Affected Products
- OCPP-compliant charging stations implementing the vulnerable ReserveLogin DataTransfer handler
- Specific vendor and product identifiers are not published in the NVD record
- Refer to the DIVD Security Advisory DIVD-2026-00001 for coordinated disclosure details
Discovery Timeline
- 2026-07-13 - CVE-2026-22100 published to the National Vulnerability Database
- 2026-07-13 - Last updated in NVD database
Technical Details for CVE-2026-22100
Vulnerability Analysis
The Open Charge Point Protocol (OCPP) defines a DataTransfer message for vendor-specific extensions between charge points and central systems. The affected implementation processes the ReserveLogin variant by passing attacker-controllable input from the data field directly to an operating system shell. Because the shell interprets metacharacters, an attacker can chain arbitrary commands onto the intended invocation.
Commands run under the root account, so the attacker inherits full privileges on the charger's embedded Linux environment. This exposes credentials, firmware, payment integrations, and physical charging control. According to the current EPSS estimate, exploitation likelihood is above average versus the general CVE population.
Root Cause
The root cause is missing input neutralization on the data parameter of the ReserveLogin DataTransfer message. The handler concatenates untrusted OCPP payload content into a shell command string without validation, allow-listing, or safe process execution APIs. This is a textbook [CWE-78] OS Command Injection flaw.
Attack Vector
The attack is delivered over the network through the OCPP WebSocket channel used between charge points and Charging Station Management Systems (CSMS). The CVSS vector indicates high privileges are required, meaning the attacker must first hold a valid OCPP session or compromise an upstream CSMS component that can send DataTransfer messages. Once positioned, the attacker sends a crafted ReserveLogin payload whose data field contains shell metacharacters and the desired command sequence. No user interaction is required.
No verified public proof-of-concept code is available. See the DIVD Security Advisory DIVD-2026-00001 for technical detail released by the coordinating CSIRT.
Detection Methods for CVE-2026-22100
Indicators of Compromise
- OCPP DataTransfer messages where messageId equals ReserveLogin and the data field contains shell metacharacters such as ;, |, &&, backticks, or $(...).
- Unexpected child processes spawned by the OCPP service, particularly shells (sh, bash) or download utilities (wget, curl, busybox).
- Outbound network connections from the charge point to attacker-controlled hosts immediately following an OCPP session.
- New or modified files in writable firmware locations, cron directories, or systemd unit paths after receipt of a ReserveLogin message.
Detection Strategies
- Inspect OCPP WebSocket traffic at the CSMS boundary and alert on ReserveLogin payloads containing non-alphanumeric characters in the data field.
- Correlate OCPP session logs with host process telemetry on the charger to flag command execution triggered by DataTransfer handlers.
- Baseline expected process trees for the OCPP service and alert on deviations, especially root-owned shell invocations.
Monitoring Recommendations
- Enable verbose OCPP application logging on both charge points and the CSMS to preserve full DataTransfer payloads for forensic review.
- Forward charger syslog, auth events, and process telemetry to a centralized SIEM or data lake for retention and correlation.
- Monitor egress traffic from charging infrastructure segments and alert on connections to unknown destinations or non-standard ports.
How to Mitigate CVE-2026-22100
Immediate Actions Required
- Restrict which OCPP peers may issue DataTransfer messages by enforcing mutual TLS and strong client authentication on the CSMS.
- Contact the charging station vendor to confirm patch availability referencing DIVD-2026-00001 and CVE-2026-22100.
- Rotate any credentials, API keys, or certificates stored on charge points that may have been exposed to root-level access.
- Isolate charge point management networks from general corporate and internet-facing networks.
Patch Information
A specific vendor patch identifier is not listed in the NVD record at publication time. Consult the DIVD Security Advisory DIVD-2026-00001 for the current list of notified vendors and remediation status, and apply firmware updates from the charge point manufacturer as they become available.
Workarounds
- Block or filter ReserveLogin DataTransfer messages at the CSMS until the charge point firmware is patched.
- Deploy an OCPP-aware proxy that validates DataTransfer data fields against a strict allow-list of characters and rejects shell metacharacters.
- Reduce the privileges of the OCPP service where the vendor permits, so command execution does not automatically inherit root.
- Disable vendor-specific DataTransfer extensions that are not required for operational use.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
