CVE-2026-44104

CriticalCVSS 9.8/10Last modified Jul 30, 2026

Description

The firmware update process for the basemodule of the charging controller only validates the CRC32 checksum without cryptographic signature verification. This allows an unauthenticated remote attacker to install a modified firmware, resulting in full system compromise.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-347

Affected software

No affected versions have been published.

Timeline

Published
Jul 30, 2026
Last modified
Jul 30, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-441056.6The credentials for the local user "user-app" may be exposed in log files, potentially enabling a low-privileged local attacker with access CVE-2026-441067.8A privilege escalation vulnerability in the init-script for user-applications allows a low-privileged local user to execute arbitrary commanCVE-2026-441077.5A reboot of the charging controller can be triggered via Modbus TCP without authentication. Therefore, when the Modbus functionality is enabCVE-2026-441089.8Due to a flaw in the execution order of scripts during shutdown, the firewall is terminated prematurely during system shutdown. This createsCVE-2026-441099.8OpenClaw before 2026.4.15 contains an authentication bypass vulnerability in Feishu webhook and card-action validation that allows unauthentCVE-2026-441108.8OpenClaw before 2026.4.15 contains an authorization bypass vulnerability in Matrix room control-command authorization that trusts DM pairingCVE-2026-441114.3OpenClaw before 2026.4.15 contains an arbitrary file read vulnerability in the QMD backend memory_get function that allows callers to read aCVE-2026-441129.6OpenClaw before 2026.4.22 contains a time-of-check/time-of-use race condition in OpenShell sandbox filesystem writes that allows attackers tCVE-2026-441137.7OpenClaw before 2026.4.22 contains a time-of-check/time-of-use race condition in the OpenShell filesystem bridge that allows attackers to reCVE-2026-441147.8OpenClaw before 2026.4.20 fails to properly reserve the OPENCLAW_ runtime-control environment namespace in workspace dotenv files, allowing CVE-2026-441158.8OpenClaw before 2026.4.22 contains an exec allowlist analysis vulnerability allowing shell expansion hiding in unquoted heredoc bodies. AttaCVE-2026-441168.6OpenClaw before 2026.4.22 contains a server-side request forgery vulnerability in the Zalo plugin's sendPhoto function that fails to validat
CVE-2026-44104: Critical severity, CVSS 9.8 | Vulnix