EV Charging Flaws Lead Critical Infrastructure
EV charging infrastructure hit by a critical unauthenticated takeover chain, while OpenAM and Keycloak disclose remote code execution and privilege escalation flaws.
Three EV charging-station management flaws from EVoke Systems expose critical infrastructure to remote takeover. CVE-2026-40702 (CVSS 9.4) allows attackers to impersonate charging stations via unauthenticated WebSocket endpoints, while CVE-2026-54479 (CVSS 7.3) weakens session binding with predictable identifiers, and CVE-2026-50176 (CVSS 7.5) omits rate limiting on authentication requests enabling brute-force and DoS attacks. Together these vulnerabilities give a remote unauthenticated attacker a full chain: discover valid sessions, brute-force credentials, and impersonate infrastructure. CISA's ICS advisory notes no known exploitation yet, but the critical severity and trivial attack vector make this a high-priority patch for fleet operators.
OpenAM ships two critical-severity flaws — an auth bypass in Liberty Web Services and a deserialization RCE in WebAuthn — both remotely exploitable without authentication. CVE-2026-45052 lets an unauthenticated attacker write persistent entries into any user's LDAP-based Liberty Discovery store via the SOAP receiver, effectively poisoning identity data at the directory level. Meanwhile CVE-2026-45051 (CWE-502) reaches arbitrary code execution through untrusted deserialization in the WebAuthn module. OpenAM is widely deployed for single sign-on across government and enterprise; no public PoC or CISA KEV listing exists yet, but the combination of unauthenticated access and code execution potential demands immediate patching.
Daktronics controller firmware exposes three distinct attack surfaces across scoreboard and display controllers used in stadiums and public venues. CVE-2026-28701 (CVSS 7.7) enables both authenticated and unauthenticated users to escape directory restrictions and enumerate arbitrary filesystem paths. The DMP-5000 models also ship with CVE-2026-31928 (CVSS 8.1), a default administrative web account with weak credentials that do not require mandatory changes during setup. CVE-2026-33560 (CVSS 7.1) exposes authenticated arbitrary file upload endpoints with no type or content validation. As per CISA's advisory, no active exploitation has been reported, but the default-credential issue alone puts thousands of deployed devices at risk of full compromise.
Keycloak discloses four vulnerabilities spanning privilege escalation, XSS, and client takeover — with the group-to-realm admin escalation carrying the highest risk. CVE-2026-9099 (CVSS 7.7) allows a group administrator to escalate privileges to realm administrator, effectively bypassing the intended administrative hierarchy. CVE-2026-9086 (CVSS 7.3) enables cross-site scripting through case-insensitive URI validation bypass, and CVE-2026-9705 (CVSS 6.5) lets an attacker re-enable and take over disabled clients by reusing Registration Access Tokens. Organizations running Keycloak for identity federation should treat the escalation bug as emergency-grade — a single compromised group admin account could lead to full realm takeover.
Schneider Electric PowerLogic P7 meters contain pre-authentication OS command injection and NULL-pointer denial-of-service flaws. CVE-2026-9717 (CVSS 7.2) allows unauthenticated remote attackers to execute arbitrary OS commands with elevated privileges, while CVE-2026-9716 (CVSS 7.5) triggers a NULL pointer dereference that renders the device's HMI and configuration interfaces unavailable. PowerLogic P7 meters are deployed across industrial energy management; CISA's advisory confirms no known public exploitation, but the pre-auth command injection is a critical red flag for OT teams managing distributed power infrastructure.
H.View IP cameras (HV-500S6 series) present two authenticated file-write vulnerabilities that can lead fully to device compromise. CVE-2026-56414 (CVSS 7.2) allows authenticated users to upload arbitrary files to fixed persistent locations without type or size validation, and CVE-2026-55975 (CVSS 7.2) enables injection of unsanitized XML into the certificate generation interface, which is then fed into a backend command. As CISA details, exploitation requires authenticated access but can chain with other weaknesses — and given that H.View cameras are widely deployed in physical security perimeters, any authenticated exposure should be treated as a full-compromise scenario.