CHARX OCPP Agent Missing Authentication Vulnerability

Technical Analysis

The vulnerability stems from the CHARX OCPP Agent exposing backend connection configuration functionality without requiring any authentication, allowing a remote attacker to directly manipulate OCPP (Open Charge Point Protocol) backend settings. Exploitation could allow redirection of the OCPP agent to an attacker-controlled backend server, enabling interception of charge point telemetry, credentials, and operational data, or disruption of service through forced misconfiguration causing DoS. Because OCPP agents function as autonomous software components that continuously communicate with backend management systems, this is architecturally analogous to an unauthenticated agent-to-controller trust boundary failure. Organizations running AI-driven orchestration or monitoring agents that ingest OCPP telemetry or interact with charging management backends could have those agent pipelines fed manipulated or attacker-controlled data, or have API keys/credentials used by such agents exposed via the disclosed backend configuration, representing a direct agent-relevant risk.

Affected Systems

CHARX OCPP Agent service (backend connection configuration component); deployments integrated with EV charging station management systems using OCPP protocol; specific affected firmware/software versions not disclosed in source data - consult vendor advisory for exact version ranges

Indicators of Compromise

• No specific IOCs published at this time (vulnerability disclosure without known exploitation reports); monitor for unauthenticated configuration requests to OCPP agent management endpoints; unexpected backend connection changes in charge point management logs

Remediation Steps

1. 1

   Apply vendor patch

   Check with the CHARX vendor for an official security update addressing CVE-2026-44101 and apply immediately upon release.

2. 2

   Restrict network access

   Place OCPP Agent management interfaces behind firewalls, VPNs, or network segmentation to prevent unauthenticated remote access from untrusted networks.

3. 3

   Enforce authentication controls

   If configurable, enable any available authentication or access control mechanisms on the backend connection configuration interface, even if not enforced by default.

4. 4

   Monitor for anomalous reconfiguration

   Implement logging and alerting on backend connection configuration changes to detect unauthorized reconfiguration attempts.

5. 5

   Audit agent-integrated systems

   Review any AI agents, automation, or monitoring pipelines that consume OCPP data or backend configurations to ensure they validate data integrity and do not trust unauthenticated sources.