External risk intelligence

Charging Controller Firmware Compromise via Unverified Updates

CVE advisorySeverity: CRITICAL (CVSS 9.3)

CVE-2026-44104

The vulnerability affects a charging controller firmware update process. While the attack is network-based, charging controllers are typically deployed within private, segmented industrial or local infrastructure networks, making direct exposure to the public internet uncommon.

Halo Surface Signal: 2 out of 5 — less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory describes a critical vulnerability in the firmware update process of charging controller basemodules. Attackers could exploit this by remotely installing modified firmware without needing prior access, potentially leading to a full system compromise. The main concern is confirming the relevance and exposure of this technology within your environment.

Modified firmware can take over charging controllers.
Critical flaw impacts unattended remote device updates.
Assess exposure and relevance of charging controllers.

Attack Path

How an attacker could exploit the issue

An attacker could remotely compromise a charging controller's basemodule by exploiting a flaw in its firmware update mechanism. This process lacks proper cryptographic signature verification, allowing an unauthenticated attacker to upload malicious firmware. Successful exploitation could lead to a complete takeover of the device's system.

No authentication required for attack.
Firmware update process is the trigger.
Results in full system compromise.

Live Threat

Current exploitation, exposure, and threat context

An unauthenticated remote attacker could install modified firmware on the charging controller's basemodule. This is possible because the firmware update process only checks the CRC32 checksum, not a cryptographic signature. When supported, this could lead to full system compromise of the charging controller.

Charging controller system data could be affected.
Modified firmware could be installed remotely.
Full system compromise of the charging controller.

Operational Fix

Recommended remediation, mitigation, and detection steps

Action for this vulnerability will likely involve teams responsible for operational technology (OT) infrastructure, specialized firmware management, and potentially network security. The first practical step is to identify all charging controller basemodules, determine their network exposure and criticality, and then assign ownership for remediation planning.

OT Infrastructure and Firmware Teams own the issue.
Verify network reachability and asset criticality.
Plan firmware update or compensating controls.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is a charging controller basemodule?

A charging controller basemodule is a core hardware component that manages energy delivery and communication for charging infrastructure. It handles critical operational tasks, including firmware updates that allow the device to receive new features or performance improvements. Because it sits at the heart of the charging process, it is a primary target for ensuring the secure operation of the unit.

What does CVE-2026-44104 mean by missing cryptographic signatures?

This vulnerability, classified as CWE-347, describes a failure to verify the authenticity of firmware updates. Instead of using cryptographic signatures to confirm that code originates from a trusted source, the system only checks a CRC32 checksum. A checksum only detects accidental data corruption, not intentional tampering. Because there is no digital signature, the device cannot distinguish between legitimate updates and malicious files injected by an attacker.

How does an attacker trigger this firmware vulnerability?

An attacker triggers this flaw by interacting directly with the device's remote firmware update mechanism without needing any authentication or valid credentials. The bug is specifically tied to the update process; simply interacting with or using the charging controller for its intended purpose does not trigger the vulnerability. The system must be placed into a state where it accepts a firmware upload for the flaw to be realized.

Why is Halo Surface Signal labeling this risk as unlikely?

Halo Surface Signal assigns an 'Unlikely' score because, although this is a network-based attack, these charging controllers are typically deployed within private, segmented industrial or local infrastructure networks. They are not commonly exposed directly to the public internet. While the technical risk is high, the practical reachability of these devices from outside a private network is generally limited, reducing the likelihood of a remote exploit.

Is there a first step for managing this charging controller issue?

Your first step is to identify all charging controller basemodules within your environment. Once identified, map out which units are reachable over the network and assess their specific criticality to your operations. This initial inventory helps you determine the priority for remediation and allows you to coordinate with the teams responsible for OT infrastructure and firmware management to plan necessary updates or apply network-level access controls.

References

www.certvde.com/en/advisories/VDE-2026-008/

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.