CVE-2026-22540

CriticalCVSS 9.2/10Last modified Jun 17, 2026

Description

The massive sending of ARP requests causes a denial of service on one board of the charger that allows control of the EV interfaces. Since the board must be operating correctly for the charger to also function correctly.

Metrics

CVSS 4.0 9.2/10

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weakness enumeration

CWE-400

Affected software

No affected versions have been published.

Timeline

Published: Jan 7, 2026
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-225418.2The massive sending of ICMP requests causes a denial of service on one of the boards from the EVCharger that allows control the EV interface CVE-2026-225429.2An attacker with access to the system's internal network can cause a denial of service on the system by making two concurrent connections th CVE-2026-225436.9The credentials required to access the device's web server are sent in base64 within the HTTP headers. Since base64 is not considered a stro CVE-2026-225448.7An attacker with a network connection could detect credentials in clear text.CVE-2026-225453.5Mattermost versions 10.11.x <= 10.11.10 fail to validate user's authentication method when processing account auth type switch which allows CVE-2026-225479.1Gitea versions before 1.25.5 lack validation constraints for repository creation fields, including length-limited template fields and trust CVE-2026-225485.9When a BIG-IP Advanced WAF or ASM security policy is configured on a virtual server, undisclosed requests along with conditions beyond the a CVE-2026-225494.9A vulnerability exists in F5 BIG-IP Container Ingress Services that may allow excessive permissions to read cluster secrets. Note: Software CVE-2026-22554.3Hitachi Vantara Pentaho Data Integration & Analytics versions before 10.2.0.6 and 11.0.0.0, including 9.3.x and 8.3.x, expose Hadoop cluster CVE-2026-225508.8OS command injection vulnerability exists in ELECOM wireless LAN products. A crafted request from a logged-in user may lead to an arbitrary CVE-2026-225516.5In Eclipse Theia versions prior to 1.71.0, the AI chat rendered Markdown image tags from AI responses, triggering HTTP requests to arbitrary CVE-2026-225529.8WebSocket endpoints lack proper authentication mechanisms, enabling attackers to perform unauthorized station impersonation and manipulate d