CVE-2026-8979: Authentication Bypass

Synopsis

An authentication bypass vulnerability affects the Mennekes Amtron series of EV charging station controllers running firmware version 5.22.3 and earlier. The flaw is reachable over the network with no authentication required, allowing an attacker to send a crafted POST request to the /operator/operator endpoint and change the password of the user account. Successful exploitation gives the attacker full control over the device account, enabling unauthorized configuration changes, service disruption, and lateral access to connected systems. No fix has been published; HarborGuard tracks the advisory for patch availability.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the device's HTTP service over the network; the vulnerable endpoint is exposed remotely with no requirement for LAN or physical proximity.

• AuthenticationNot required

  No credentials of any kind are needed; the crafted POST request can be sent by a completely unauthenticated attacker.

• Victim interactionNot required

  The attack is fully automated and requires no action from any user or operator of the device.

• Attack complexityDetail

  Exploit conditions are straightforward and reliable, requiring no race conditions, special memory layout, or environmental setup beyond network access to the endpoint.

Blast Radius

• The attacker overwrites the user account password, locking out the legitimate operator and taking sole control of the device account.
• With account control, the attacker can reconfigure charging behavior, disable the charging station, or enable unauthorized charging sessions.
• System and supporting-infrastructure confidentiality is fully compromised: the attacker reads stored credentials, session data, and device configuration.
• Downstream systems connected to the same network segment are exposed to lateral movement from a now-attacker-controlled device.