CVE-2026-22539 MEDIUM

CVE-2026-22539: INFORMATION DISCLOSURE VIA CURL REQUESTS (OCPP)

Vendor Efacec

Product QC 60/90/120

Weakness CWE-201

Published January 7, 2026

Last update January 9, 2026

View on NVD All CVEs

CVSS base score

5.3/10

Attack vector Adjacent

Attack complexity Low

Privileges required None

User interaction None

Confidentiality —

Integrity —

CVSS vector

CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

What the vulnerability does

01Description

As the service interaction is performed without authentication, an attacker with some knowledge of the protocol could obtain information about the charger via OCPP v1.6.

Key dates

02Disclosure timeline

January 7, 2026 CVE published

January 9, 2026 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2026-22539 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/201.html

Related vulnerabilities

04Related CVE

CVE-2025-59003 WordPress ColorWay Theme <= 4.2.3 - Sensitive Data Exposure Vulnerability CVE-2025-65944 Sentry-Javascript deals with leaked sensitive headers when `sendDefaultPii` is set to `true` CVE-2025-63071 WordPress Shortcodes and extra features for Phlox theme plugin <= 2.17.15 - Sensitive Data Exposure vulnerability CVE-2026-39709 WordPress The Tribal plugin <= 1.3.4 - Sensitive Data Exposure vulnerability CVE-2025-62038 WordPress MeetingHub plugin <= 1.23.9 - Sensitive Data Exposure vulnerability