CVE-2026-22541 is a vulnerability classified under CWE-400 (Uncontrolled Resource Consumption) affecting EFACEC's QC 60/90/120 electric vehicle chargers, specifically version 8. The flaw arises from the device's susceptibility to a denial of service attack via a flood of ICMP requests targeting one of the internal control boards responsible for managing EV interfaces. This board must operate correctly for the charger to function; overwhelming it with ICMP traffic exhausts its resources, causing it to fail and thus disabling the charger. The vulnerability is remotely exploitable without requiring authentication or user interaction, increasing its risk profile. The CVSS 4.0 score of 8.2 (high severity) reflects the network attack vector, low complexity, no privileges required, no user interaction, and a high impact on availability. While no public exploits have been reported, the potential for disruption to EV charging infrastructure is significant, especially given the increasing reliance on electric vehicles in Europe. The lack of available patches at the time of reporting necessitates immediate network-level mitigations and monitoring. EFACEC chargers are deployed widely in Europe, particularly in Portugal (EFACEC's home country), Germany, France, and the Netherlands, where EV adoption is high and charging infrastructure is critical. This vulnerability highlights the importance of securing industrial IoT and critical infrastructure devices against resource exhaustion attacks.

The primary impact of CVE-2026-22541 is a denial of service condition that disables EFACEC QC 60/90/120 EV chargers by exhausting the resources of a critical control board via ICMP flooding. For European organizations, this can lead to significant operational disruptions in EV charging infrastructure, affecting public and private charging stations. This disruption can impede EV fleet operations, reduce availability for consumers, and potentially cause economic losses and reputational damage to charging service providers. Given the increasing push for electric mobility across Europe, such outages could slow EV adoption and undermine confidence in charging networks. Critical infrastructure operators, municipalities, and commercial fleet operators relying on EFACEC chargers are particularly vulnerable. The attack does not compromise confidentiality or integrity but severely impacts availability, which is crucial for infrastructure reliability. The ease of exploitation without authentication and the remote attack vector increase the likelihood of targeted or opportunistic attacks, especially in countries with dense EV infrastructure and EFACEC deployments.

1. Implement network-level filtering to limit or block excessive ICMP traffic directed at EFACEC QC 60/90/120 chargers, using firewalls or intrusion prevention systems to detect and mitigate ICMP floods. 2. Segment EV charger management networks from general corporate or public networks to reduce exposure to external attacks. 3. Monitor network traffic for unusual ICMP activity patterns indicative of resource exhaustion attempts. 4. Engage with EFACEC support channels to obtain firmware updates or patches as they become available and prioritize their deployment. 5. Employ rate limiting on network devices to restrict the volume of ICMP packets reaching the chargers. 6. Conduct regular security assessments of EV charging infrastructure to identify and remediate potential vulnerabilities. 7. Develop incident response plans specifically addressing EV charger outages to minimize downtime and impact. 8. Consider deploying redundant charging infrastructure to maintain service availability during targeted attacks.