CVE-2026-44101: CHARX OCPP Agent Auth Bypass Vulnerability

CVE-2026-44101 Overview

CVE-2026-44101 is a missing authentication vulnerability [CWE-306] in the CHARX Open Charge Point Protocol (OCPP) Agent service. The service exposes backend connection reconfiguration functionality without requiring any form of authentication. An unauthenticated remote attacker with network access can redirect the agent to an attacker-controlled backend. This enables denial-of-service conditions and disclosure of confidential charging session data. The flaw affects electric vehicle charging infrastructure that relies on the CHARX OCPP Agent to communicate with backend management systems.

Critical Impact
An unauthenticated network attacker can reconfigure the OCPP backend connection, causing denial-of-service and exposing confidential operational data.

Affected Products

CHARX OCPP Agent service (see CERT-VDE Security Advisory VDE-2026-008 for specific version details)

Discovery Timeline

2026-07-30 - CVE-2026-44101 published to the National Vulnerability Database (NVD)
2026-07-30 - Last updated in NVD database

Technical Details for CVE-2026-44101

Vulnerability Analysis

The CHARX OCPP Agent implements a backend connection management interface that accepts reconfiguration requests over the network. The service does not enforce authentication on these requests. Any attacker able to reach the service on the network can invoke reconfiguration functionality intended for administrators.

OCPP is the communication protocol between electric vehicle charging stations and central management systems. Redirecting an agent's backend endpoint places the attacker between the charge point and its legitimate operator. The attacker receives session telemetry, transaction data, and connected client information that should remain confidential.

Exploitation also enables denial-of-service. Pointing the agent to a non-existent or attacker-controlled endpoint disrupts charging operations and prevents the charge point from communicating with its legitimate management platform.

Root Cause

The root cause is a missing authentication check [CWE-306] on a security-sensitive administrative function. The reconfiguration endpoint treats network reachability as sufficient authorization. No credential, token, or session validation gates the operation.

Attack Vector

The attack vector is network-based and requires no user interaction, no privileges, and no prior access. An attacker sends a crafted reconfiguration request to the exposed CHARX OCPP Agent service and changes the backend URL to a host under attacker control. The CHARX OCPP Agent then establishes its outbound session with the attacker's endpoint.

The vulnerability manifests in the backend connection reconfiguration handler. See the CERT-VDE Security Advisory for vendor-provided technical details.

Detection Methods for CVE-2026-44101

Indicators of Compromise

Unexpected changes to the OCPP backend URL or connection configuration on CHARX charge points.
Outbound OCPP or WebSocket sessions from charging equipment to unrecognized external hosts.
Loss of connectivity between charge points and the legitimate central management system, followed by silent recovery to a different endpoint.

Detection Strategies

Monitor outbound network flows from OCPP agents and alert on new destination hostnames or IP addresses not on an approved backend list.
Baseline the configured backend URL on each device and periodically compare against the running configuration.
Inspect service logs from the CHARX OCPP Agent for reconfiguration events without a corresponding administrative session.

Monitoring Recommendations

Capture NetFlow or packet metadata for the OT/IoT network segment hosting charging equipment.
Forward device and network telemetry to a central analytics platform for correlation and long-term retention.
Alert on any inbound connections to the CHARX OCPP Agent management interface from outside authorized administrative subnets.

How to Mitigate CVE-2026-44101

Immediate Actions Required

Restrict network access to the CHARX OCPP Agent management interface using firewall rules or network segmentation.
Place charging infrastructure on a dedicated VLAN reachable only from authorized management hosts.
Audit current backend configuration on all deployed CHARX OCPP Agents and confirm each device points to the intended endpoint.
Review outbound OCPP traffic for connections to unknown destinations.

Patch Information

Refer to the CERT-VDE Security Advisory VDE-2026-008 for vendor patch availability, fixed firmware versions, and upgrade guidance. Apply vendor-supplied updates as soon as they are validated in your environment.

Workarounds

Block network access to the OCPP Agent's management port from untrusted networks until a patch is applied.
Deploy an authenticated reverse proxy or VPN in front of any management interface that must remain accessible.
Implement strict egress filtering so charge points can only reach the approved backend endpoint.
Continuously monitor device configuration for unauthorized changes.

bash

# Example egress allow-list restricting OCPP Agent to approved backend
# Replace <MGMT_SUBNET>, <AGENT_IP>, and <BACKEND_IP> with your values
iptables -A INPUT -s <MGMT_SUBNET> -d <AGENT_IP> -p tcp --dport 8080 -j ACCEPT
iptables -A INPUT -d <AGENT_IP> -p tcp --dport 8080 -j DROP
iptables -A OUTPUT -s <AGENT_IP> -d <BACKEND_IP> -p tcp --dport 443 -j ACCEPT
iptables -A OUTPUT -s <AGENT_IP> -j DROP