VulnerabilityDeferred

CVE-2026-44104

This allows an unauthenticated remote attacker to install a modified firmware, resulting in full system compromise.

CRITICAL 9.3EPSS 0.27%

Does this matter?

High impact if exploited, but EPSS currently rates exploitation as unlikely (0.27%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.

Description

The firmware update process for the basemodule of the charging controller only validates the CRC32 checksum without cryptographic signature verification. This allows an unauthenticated remote attacker to install a modified firmware, resulting in full system compromise.

CVSS 4.0: 9.3 CRITICALCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/M
EPSS: 0.27% probability · 19th percentile
CISA KEV: Not listed
Weakness: CWE-347
Source: info@cert.vde.com

References

https://www.certvde.com/en/advisories/VDE-2026-008/

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.