A critical missing authentication vulnerability in the CHARX OCPP Agent allows unauthenticated attackers to reconfigure backend connections, leading to denial of service and potential data disclosure.

This is a missing authentication for critical function vulnerability (CWE-306). The OCPP Agent service fails to verify the identity of remote entities, granting an unauthenticated attacker the ability to alter backend connection settings.

Exploitation of this vulnerability enables attackers to disrupt charging station operations through denial of service or divert sensitive data by reconfiguring backend connections. Given the CVSS score of 9.8, the potential for service outages and information leakage is substantial. This risk is particularly high for operators of charging infrastructure who rely on secure connectivity to the backend management platform.

Immediate Action: Update the firmware of all affected CHARX SEC devices to version 1.9.1 or higher to enforce authentication for the OCPP Agent service.

Proactive Monitoring: Monitor the status of backend connections and review logs for unauthorized reconfiguration attempts or unexpected connection drops in the charging management system.

Compensating Controls: Restrict network access to the OCPP Agent service by implementing strict firewall rules and network segmentation, ensuring only verified management servers can communicate with the device.

Public Exploit Available: Unknown

Operators must treat this vulnerability with high urgency to prevent potential operational downtime and data exposure. It is essential to apply the manufacturer-provided firmware updates and verify network security controls to protect the integrity of the backend management communications.