CVE-2026-22540: EV Charger Board DoS Vulnerability

CVE-2026-22540 Overview

CVE-2026-22540 is a critical denial of service vulnerability affecting electric vehicle (EV) charger infrastructure. The vulnerability allows attackers to cause a denial of service condition on the charger's control board through massive ARP (Address Resolution Protocol) request flooding. Since the control board is responsible for managing EV interfaces and is essential for proper charger operation, successful exploitation renders the entire charging station inoperable.

Critical Impact
Attackers can remotely disable EV charging stations through network-based ARP flooding attacks, potentially disrupting critical charging infrastructure and causing service outages across charging networks.

Affected Products

EV charger control boards with network connectivity
Charging station management systems vulnerable to ARP flooding
EV interface controllers exposed to network traffic

Discovery Timeline

2026-01-07 - CVE CVE-2026-22540 published to NVD
2026-01-08 - Last updated in NVD database

Technical Details for CVE-2026-22540

Vulnerability Analysis

This vulnerability is classified under CWE-400 (Uncontrolled Resource Consumption), indicating that the affected control board lacks adequate protections against resource exhaustion attacks. The EV charger's network-facing control board fails to implement proper rate limiting or filtering mechanisms for incoming ARP requests, allowing an attacker to overwhelm the device's processing capabilities.

When the control board is flooded with ARP requests, it becomes unable to process legitimate network traffic and perform its critical functions of managing EV charging interfaces. Since the charger's operation depends on this board functioning correctly, the entire charging station becomes non-functional during the attack.

Root Cause

The root cause of CVE-2026-22540 stems from insufficient resource consumption controls in the ARP request handling mechanism of the EV charger control board. The device accepts and attempts to process all incoming ARP requests without implementing throttling, filtering, or queue management mechanisms. This design flaw allows malicious actors to consume all available processing resources by sending a high volume of ARP packets.

Attack Vector

The attack can be executed remotely over the network (AV:N) with low complexity (AC:L) and requires no authentication (PR:N) or user interaction (UI:N). An attacker with network access to the EV charger's control board segment can initiate the attack by flooding the device with ARP requests using standard network tools.

The attack involves sending a massive number of ARP requests targeting the control board's network interface. As the board attempts to process each request, its resources become exhausted, leading to denial of service. The attack affects both the vulnerable system's availability and can have subsequent downstream impacts on connected systems and the overall charging infrastructure.

Detection Methods for CVE-2026-22540

Indicators of Compromise

Abnormally high volume of ARP traffic directed at EV charger control boards
Sudden unavailability of EV charging stations without apparent hardware failure
Network interface statistics showing ARP request flooding patterns
Control board becoming unresponsive to legitimate management traffic

Detection Strategies

Deploy network monitoring to detect anomalous ARP traffic volumes targeting charging infrastructure
Implement IDS/IPS rules to identify and alert on ARP flooding patterns
Monitor EV charger availability metrics for unexpected service disruptions
Configure SIEM alerts for unusual ARP request rates on charging network segments

Monitoring Recommendations

Establish baseline ARP traffic patterns for normal charging station operations
Implement real-time network traffic analysis at charging infrastructure network boundaries
Deploy SNMP or similar monitoring for control board health and responsiveness
Create dashboards to visualize charging station availability across the network

How to Mitigate CVE-2026-22540

Immediate Actions Required

Isolate EV charger control boards on dedicated network segments with controlled access
Implement ARP rate limiting at network switch or firewall level
Deploy network access control to restrict which devices can communicate with charging infrastructure
Enable ARP inspection features on network switches where available

Patch Information

Organizations should consult the Thales Group Security Resources for the latest security updates and firmware patches addressing this vulnerability. Contact the EV charger vendor directly for device-specific remediation guidance and patch availability.

Workarounds

Configure network switches to implement dynamic ARP inspection (DAI) to validate ARP packets
Deploy rate limiting rules on network devices to restrict ARP traffic volume
Use VLANs to segment charging infrastructure from general network traffic
Implement access control lists (ACLs) to restrict network access to charging equipment
Consider deploying dedicated security appliances to filter malicious traffic before it reaches charging infrastructure

bash

# Example network switch configuration for ARP rate limiting
# Cisco IOS example - adapt for your specific equipment
interface GigabitEthernet0/1
  description EV_Charger_Connection
  ip arp inspection limit rate 15
  switchport access vlan 100
  switchport port-security maximum 2
  spanning-tree portfast