CVE-2026-44092

CriticalCVSS 9.1/10Last modified Jul 30, 2026

Description

An unauthenticated remote attacker can inject malicious input into the ModbusServer application because it does not validate the input it fetches from MQTT. This may lead to integrity and availability loss.

Metrics

CVSS 3.1 9.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

Weakness enumeration

CWE-93

Affected software

No affected versions have been published.

Timeline

Published: Jul 30, 2026
Last modified: Jul 30, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-440937.8A local privilege escalation vulnerability in the init-script for user-applications allows a low-privileged local user to execute arbitrary CVE-2026-440948.6An unauthenticated remote attacker can enforce the system to fall back to a firmware partition with an insecure configuration including defa CVE-2026-440957.8A privilege escalation vulnerability in a script used for network configuration allows a low-privileged local user to execute arbitrary comm CVE-2026-440967.8A privilege escalation vulnerability in udhcpc allows a local user "charx-web" to execute arbitrary commands as root, resulting in full syst CVE-2026-440977.1A low-privileged remote attacker with "operator" access can upload arbitrary files via the REST endpoint intended for firmware updates, resu CVE-2026-440988.6This vulnerability allows an unauthenticated remote attacker with control over the OCPP backend via firewall-bypass to perform an OS command CVE-2026-440997.8A privilege escalation vulnerability in the system configuration allows a low-privileged local user to execute arbitrary commands as root, r CVE-2026-44107.5IBM WebSphere Application Server - Liberty 19.0.0.7 through 26.0.0.5 and IBM WebSphere Application Server 9.0, and 8.5 and WebSphere Applica CVE-2026-441009.4The CHARX JupiCore service allows an unauthenticated remote attacker to reconfigure charging points. This can lead to disclosure of charging CVE-2026-441019.8Due to missing authentication the CHARX OCPP Agent service allows an unauthenticated remote attacker to reconfigure the backend connection. CVE-2026-441025.3An unauthenticated remote attacker can trigger a firmware update download via the OCPP backend by supplying an invalid firmware file. This w CVE-2026-441035.3An unauthenticated remote attacker can inject malicious firmware into the internal charging module because the JupiCore service transmits fi