An unauthenticated remote attacker can trigger a firmware update download via the OCPP backend by supplying an invalid firmware file. (CVE-2026-44102)
An unauthenticated remote attacker can cause a firmware update download via the OCPP backend by supplying an invalid firmware file. The invalid file remains accessible temporarily due to improper locking during cleanup. This vulnerability is related to a race condition (CWE-362). No patch or remediation details are currently available.
AI Analysis
Technical Summary
CVE-2026-44102 describes a vulnerability in an OCPP backend where an unauthenticated remote attacker can trigger a firmware update download by submitting an invalid firmware file. The improper locking during the cleanup process causes the invalid file to remain accessible for a short time before deletion. This behavior indicates a race condition vulnerability (CWE-362). There is no information about available patches or fixes, and no known exploits in the wild have been reported.
Potential Impact
The vulnerability allows unauthenticated remote attackers to trigger firmware update downloads with invalid files, which remain accessible briefly due to improper cleanup locking. This could potentially lead to unauthorized access to firmware files during that window. However, no direct exploitation details or further impact are provided.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or workaround information is available at this time.
An unauthenticated remote attacker can trigger a firmware update download via the OCPP backend by supplying an invalid firmware file. (CVE-2026-44102)
Description
An unauthenticated remote attacker can cause a firmware update download via the OCPP backend by supplying an invalid firmware file. The invalid file remains accessible temporarily due to improper locking during cleanup. This vulnerability is related to a race condition (CWE-362). No patch or remediation details are currently available.
CVSS v4.0
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-44102 describes a vulnerability in an OCPP backend where an unauthenticated remote attacker can trigger a firmware update download by submitting an invalid firmware file. The improper locking during the cleanup process causes the invalid file to remain accessible for a short time before deletion. This behavior indicates a race condition vulnerability (CWE-362). There is no information about available patches or fixes, and no known exploits in the wild have been reported.
Potential Impact
The vulnerability allows unauthenticated remote attackers to trigger firmware update downloads with invalid files, which remain accessible briefly due to improper cleanup locking. This could potentially lead to unauthorized access to firmware files during that window. However, no direct exploitation details or further impact are provided.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or workaround information is available at this time.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-qrwj-j5f7-cjgm
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-44102"]
- Ecosystems
- []
- Database Specific Severity
- MODERATE
- Cvss Version
- 4.0
Threat ID: 6a6b72bb9c2644c7f8473cb2
Added to database: 07/30/2026, 15:50:19 UTC
Last enriched: 07/30/2026, 20:08:33 UTC
Last updated: 07/31/2026, 03:32:08 UTC
Views: 4
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.