CVE-2026-44103

MediumCVSS 5.3/10Last modified Jul 30, 2026

Description

An unauthenticated remote attacker can inject malicious firmware into the internal charging module because the JupiCore service transmits firmware updates without performing integrity or verification check. Successful exploitation may compromise the integrity of the affected device. This vulnerability could be used in chain with CVE-2026-44104.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-434

Affected software

No affected versions have been published.

Timeline

Published: Jul 30, 2026
Last modified: Jul 30, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-441049.8The firmware update process for the basemodule of the charging controller only validates the CRC32 checksum without cryptographic signature CVE-2026-441056.6The credentials for the local user "user-app" may be exposed in log files, potentially enabling a low-privileged local attacker with access CVE-2026-441067.8A privilege escalation vulnerability in the init-script for user-applications allows a low-privileged local user to execute arbitrary comman CVE-2026-441077.5A reboot of the charging controller can be triggered via Modbus TCP without authentication. Therefore, when the Modbus functionality is enab CVE-2026-441089.8Due to a flaw in the execution order of scripts during shutdown, the firewall is terminated prematurely during system shutdown. This creates CVE-2026-441099.8OpenClaw before 2026.4.15 contains an authentication bypass vulnerability in Feishu webhook and card-action validation that allows unauthent CVE-2026-441108.8OpenClaw before 2026.4.15 contains an authorization bypass vulnerability in Matrix room control-command authorization that trusts DM pairing CVE-2026-441114.3OpenClaw before 2026.4.15 contains an arbitrary file read vulnerability in the QMD backend memory_get function that allows callers to read a CVE-2026-441129.6OpenClaw before 2026.4.22 contains a time-of-check/time-of-use race condition in OpenShell sandbox filesystem writes that allows attackers t CVE-2026-441137.7OpenClaw before 2026.4.22 contains a time-of-check/time-of-use race condition in the OpenShell filesystem bridge that allows attackers to re CVE-2026-441147.8OpenClaw before 2026.4.20 fails to properly reserve the OPENCLAW_ runtime-control environment namespace in workspace dotenv files, allowing CVE-2026-441158.8OpenClaw before 2026.4.22 contains an exec allowlist analysis vulnerability allowing shell expansion hiding in unquoted heredoc bodies. Atta