CVE-2026-44104CWE-347

ControllerAgent does not perform validation of firmware

Critical · published July 30, 2026

CVSS v4.0
9.3
EPSS
0%
Percentile
34.3
In the wild
Unconfirmed
What it is

The firmware update process for the basemodule of the charging controller only validates the

CRC32 checksum without cryptographic signature verification. This allows an unauthenticated remote attacker to install a modified firmware, resulting in full system compromise.

The record
Technical detail
CVSS v4.0
9.3 · CRITICAL
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS
0.00412 · 34.3th percentile
Weakness
CWE-347 · Improper Verification of Cryptographic Signature
Published
2026-07-30T06:52Z
EPSS history
Timeline
  • 30 JUL 06:52Z
    ControllerAgent does not perform validation of firmware
    cvelistv5