Loading story…
CyberDanube Security Research disclosed two high-impact vulnerabilities in MENNEKES Amtron Series and Smart-T PnC charging products running firmware 5.22.3 and earlier. CVE-2026-8979 is an authentication bypass (CWE-287) that lets an unauthenticated remote attacker change a user account password by sending a crafted POST request to the /operator/operator endpoint, while CVE-2026-8980 is a privilege-escalation flaw (CWE-269) that allows a low-privileged authenticated user to change the passwords of the admin/operator and manufacturer accounts.
The flaws were published through Full Disclosure and CVE records, with CyberDanube naming S. Eisenreich-Dietz and Thomas Weber as the researchers. The advisory says the issues are fixed in firmware 5.33.11-21500 and urges operators to update to the latest firmware; where immediate patching is not possible, access to the devices should be restricted because the vulnerabilities can enable unauthorized control over charger accounts and administrative functions.
See affected versions and whether adversaries are exploiting it.
5 events from the most recent confirmed update back to the earliest known activity.
On 2026-05-28, CVE-2026-8980 was recorded for a privilege-escalation flaw in Mennekes Amtron firmware 5.22.3 and earlier that allows a low-privileged authenticated user to change admin and manufacturer account passwords through crafted POST requests.
On 2026-05-28, CVE-2026-8979 was recorded for an authentication bypass in Mennekes Amtron firmware 5.22.3 and earlier that lets an unauthenticated remote attacker change a user account password via a crafted POST request to /operator/operator.
On 2026-05-28, CyberDanube Security Research disclosed CVE-2026-8979, an authentication bypass allowing unauthenticated password changes, and CVE-2026-8980, a privilege-escalation flaw allowing a low-privileged user to change admin and manufacturer passwords.
CyberDanube's advisory states that firmware version 5.33.11-21500 fixes CVE-2026-8979 and CVE-2026-8980 affecting Mennekes Amtron Series and Smart-T PnC charging products.
CyberDanube Security Research said vendor contact regarding the Mennekes Amtron Series vulnerabilities began in February 2025.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
3 references tracked. Mallory keeps watching after this page renders.
cvefeed.io
Open sourcecvefeed.io
Open sourceseclists.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
**Siemens Heliox EV chargers** were disclosed to contain an **improper access control** weakness (CWE-923) that could allow an attacker with physical access to the charging interface to reach **unauthorized services via the charging cable**. CISA published an ICS advisory describing the issue and noting Siemens has released updated software versions; the advisory lists affected models including the **Heliox Flex 180 kW EV Charging Station** and **Heliox Mobile DC 40 kW EV Charging Station**, and scores the issue **CVSS v3.1 2.6 (Low)** with a vector indicating a **physical** attack requirement (e.g., `AV:P`). Siemens recommends updating to fixed versions and protecting device/network access per its industrial security operational guidelines. Canada’s Centre for Cyber Security also highlighted Siemens’ March 2026 advisory set, including updates for **Heliox Flex (prior to F4.11.1)** and **Heliox Mobile DC 40 (prior to L4.10.1)**, alongside unrelated Siemens product lines (e.g., Mendix, RUGGEDCOM, SIMATIC). A separate Canadian advisory covering **Schneider Electric** products (EcoStruxure and Modicon lines) is a different vendor’s disclosure and does not pertain to the Siemens Heliox EV charger vulnerability.
Jun 29, 2026
High-severity vulnerabilities were disclosed in **OpenClaw** and **CTEK Chargeportal**, with both flaws tied to insecure WebSocket handling that can let attackers gain unauthorized control. In **CVE-2026-22172**, OpenClaw versions prior to `2026.3.12` fail to properly bind authorized scopes in shared-token or password-authenticated WebSocket sessions, allowing a low-privileged user to self-assign elevated permissions such as `operator.admin` and perform admin-only gateway operations. The issue is classified as **CWE-862** and carries a CVSS v3.1 score reflecting high impact to confidentiality, integrity, and availability. In **CVE-2026-25192**, CTEK Chargeportal exposes WebSocket endpoints that do not properly authenticate critical functions, enabling an unauthenticated attacker to impersonate EV charging stations by using a known or discovered station identifier. That access can be used to send or receive **OCPP** commands as a legitimate charger, potentially leading to unauthorized control of charging infrastructure, privilege escalation, and corruption of backend charging data. The flaw is tracked as **CWE-306** and is covered in **CISA** advisory `ICSA-26-078-06`, with impact rated high for confidentiality and integrity.
Jun 29, 2026
Two high-severity vulnerabilities, **CVE-2026-5548** and **CVE-2026-5550**, were disclosed in **Tenda AC10** firmware `16.03.10.10_multi_TDE01`, both affecting the `/bin/httpd` component. The flaws are stack-based buffer overflows in the `fromSysToolChangePwd` function, where crafted input to the `sys.userpass` argument can trigger memory corruption during password-change handling. Both entries classify the issue under **CWE-119** and **CWE-121** and indicate the vulnerabilities can be exploited remotely. Severity metadata attached to the CVE records shows high impact on **confidentiality, integrity, and availability**, with CVSS v3.1 scoring reflecting **network attackability**, **low attack complexity**, **low privileges required**, and **no user interaction**. The disclosures were accompanied by references to a GitHub technical finding, VulDB records, and Tenda-related resources, indicating that multiple endpoints tied to the same password-management code path may be exposed in affected devices.
Jun 29, 2026