{"id":"CVE-2026-22541","state":"PUBLISHED","title":"DENIAL OF SERVICE VIA ICMP PACKETS","description":"The massive sending of ICMP requests causes a denial of service on one of the boards from the EVCharger that allows control the EV interfaces. Since the board must be operating correctly for the charger to also function correctly.","publishedAt":"2026-01-07T15:12:42.368Z","updatedAt":"2026-01-07T15:29:55.282Z","severity":{"score":8.2,"label":"High","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","source":"S21sec"},"assigner":"S21sec","products":["EFACEC QC 60/90/120"],"affected":[{"vendor":"EFACEC","product":"QC 60/90/120","defaultStatus":"unaffected","versions":[{"version":"8","status":"affected"}]}],"references":["https://cds.thalesgroup.com/en"],"weaknesses":["CWE-400"],"ingestedAt":"2026-10-29T20:11:21.040Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/22xxx/CVE-2026-22541.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-22541","state":"PUBLISHED","datePublished":"2026-01-07T15:12:42.368Z","dateUpdated":"2026-01-07T15:29:55.282Z","assignerShortName":"S21sec","assignerOrgId":"50b5080a-775f-442e-83b5-926b5ca517b6","dateReserved":"2026-01-07T14:01:04.829Z"},"containers":{"cna":{"title":"DENIAL OF SERVICE VIA ICMP PACKETS","descriptions":[{"lang":"en","value":"The massive sending of ICMP requests causes a denial of service on one of the boards from the EVCharger that allows control the EV interfaces. Since the board must be operating correctly for the charger to also function correctly."}],"affected":[{"vendor":"EFACEC","product":"QC 60/90/120","defaultStatus":"unaffected","versions":[{"version":"8","status":"affected"}]}],"references":[{"url":"https://cds.thalesgroup.com/en"}],"metrics":[{"cvssV4_0":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"NETWORK","baseScore":8.2,"baseSeverity":"HIGH","exploitMaturity":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-400","description":"CWE-400 Uncontrolled Resource Consumption","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"S21sec","orgId":"50b5080a-775f-442e-83b5-926b5ca517b6","dateUpdated":"2026-01-07T15:12:42.368Z"},"credits":[{"lang":"en","type":"finder","value":"Aarón Flecha Menéndez"},{"lang":"en","type":"finder","value":"Iván Alonso Álvarez"},{"lang":"en","type":"finder","value":"Víctor Bello Cuevas"}],"impacts":[{"capecId":"CAPEC-125","descriptions":[{"lang":"en","value":"CAPEC-125 Flooding"}]}],"source":{"discovery":"UNKNOWN"},"tags":["x_DoS","x_ICMP","x_ICS","x_Charger"],"x_generator":{"engine":"Vulnogram 0.5.0"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2026-01-07T15:27:51.618694Z","id":"CVE-2026-22541","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-01-07T15:29:55.282Z"}}]}}}