Unrated severityNVD Advisory· Published Jul 30, 2026· Updated Jul 30, 2026
OS Command Injection in OCPP Agent via charge_box_id
CVE-2026-44098
Description
This vulnerability allows an unauthenticated remote attacker with control over the OCPP backend via firewall-bypass to perform an OS command injection, resulting in the execution of arbitrary commands as the limited user charx-oa. Charging could be interrupted.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
1Patches
Vulnerability mechanics
References
1News mentions
0No linked articles in our index yet.