An unauthenticated remote attacker can cause a firmware update download via the OCPP backend by supplying an invalid firmware file. The invalid file remains accessible temporarily due to improper locking during cleanup. This vulnerability is related to a race condition (CWE-362). No patch or remediation details are currently available.