CVE-2026-8980: Privilege Escalation

Synopsis

A privilege escalation vulnerability affects the Mennekes Amtron series of EV charging station firmware at versions 5.22.3 and earlier. The flaw is reachable over the network and requires only a low-privilege authenticated session, meaning any registered user can send crafted HTTP POST requests to overwrite the passwords of administrator and manufacturer accounts. Successful exploitation gives the attacker full administrative control over the charging station, including the ability to read sensitive configuration data, tamper with charging session records, and disrupt station operation. HarborGuard is tracking the advisory for patch availability, as no fix version has been published.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the Amtron firmware's HTTP interface over the network; local or physical access is not required.

• AuthenticationRequired

  A low-privilege account is sufficient; the attacker does not need admin credentials, only any valid user session on the device.

• Victim interactionNot required

  No victim action is needed; the attacker sends crafted POST requests directly without any social-engineering step.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is straightforward and reliable with no race conditions or special environmental factors required.

Blast Radius

• Attacker overwrites the admin (operator) account password, locking out the legitimate administrator and taking full control of the device.
• Attacker overwrites the manufacturer account password, gaining the highest privilege tier and access to all configuration and diagnostic functions.
• With admin control, the attacker reads stored charging session data, network credentials, and device configuration from the station.
• The attacker can alter charging behavior or disable the station entirely, disrupting EV charging service for end users.