CVE-2026-22535

HighCVSS 8.9/10Last modified Jun 17, 2026

Description

An attacker with the ability to interact through the network and with access credentials, could, thanks to the unsecured (unencrypted) MQTT communications protocol, write on the server topics of the board that controls the MQTT communications

Metrics

CVSS 4.0 8.9/10

CVSS:4.0/AV:A/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weakness enumeration

CWE-1366

Affected software

No affected versions have been published.

Timeline

Published: Jan 7, 2026
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-225368.6The absence of permissions control for the user XXX allows the current configuration in the sudoers file to escalate privileges without any CVE-2026-225376.8The lack of hardening of the system allows the user used to manage and maintain the charger to consult different files containing clear-text CVE-2026-225395.3As the service interaction is performed without authentication, an attacker with some knowledge of the protocol could obtain information abo CVE-2026-22546.3Hitachi Vantara Pentaho Data Integration & Analytics versions before 10.2.0.6 and 11.0.0.0, including 9.3.x and 8.3.x, does not apply ACLs o CVE-2026-225409.2The massive sending of ARP requests causes a denial of service on one board of the charger that allows control of the EV interfaces. Since t CVE-2026-225418.2The massive sending of ICMP requests causes a denial of service on one of the boards from the EVCharger that allows control the EV interface CVE-2026-225429.2An attacker with access to the system's internal network can cause a denial of service on the system by making two concurrent connections th CVE-2026-225436.9The credentials required to access the device's web server are sent in base64 within the HTTP headers. Since base64 is not considered a stro CVE-2026-225448.7An attacker with a network connection could detect credentials in clear text.CVE-2026-225453.5Mattermost versions 10.11.x <= 10.11.10 fail to validate user's authentication method when processing account auth type switch which allows CVE-2026-225479.1Gitea versions before 1.25.5 lack validation constraints for repository creation fields, including length-limited template fields and trust CVE-2026-225485.9When a BIG-IP Advanced WAF or ASM security policy is configured on a virtual server, undisclosed requests along with conditions beyond the a