Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 13

Export CSV
CVE-2023-6689

Cross-Site Request Forgery in EFACEC BCU 500

A successful CSRF attack could force the user to perform state changing requests on the application. If the victim is an administrative account, a CSRF attack could compromise the entire web application.

CVSS 3.1 · 8.2 High EPSS < 1% KEV · Not listed
Vendors
Efacec
Products
Bcu 500 Bcu 500 Firmware
CVE-2023-50706

Improper Access Control in EFACEC UC 500E

A user without administrator permissions with access to the UC500 windows system could perform a memory dump of the running processes and extract clear credentials or valid session tokens.

CVSS 3.1 · 4.1 Medium EPSS < 1% KEV · Not listed
Vendors
Efacec
Products
Uc 500e Uc 500e Firmware
CVE-2026-22541

DENIAL OF SERVICE VIA ICMP PACKETS

The massive sending of ICMP requests causes a denial of service on one of the boards from the EVCharger that allows control the EV interfaces. Since the board must be operating correctly for the charger to also function correctly.

CVSS 4.0 · 8.2 High EPSS < 1% KEV · Not listed
Vendors
Efacec
Products
Qc 120 Qc 60 Qc 90
CVE-2026-22539

INFORMATION DISCLOSURE VIA CURL REQUESTS (OCPP)

As the service interaction is performed without authentication, an attacker with some knowledge of the protocol could obtain information about the charger via OCPP v1.6.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Efacec
Products
Qc 120 Qc 60 Qc 90
CVE-2026-22540

DENIAL OF SERVICE VIA ARP PACKETS

The massive sending of ARP requests causes a denial of service on one board of the charger that allows control of the EV interfaces. Since the board must be operating correctly for the charger to also function correctly.

CVSS 4.0 · 9.2 Critical EPSS < 1% KEV · Not listed
Vendors
Efacec
Products
Qc 120 Qc 60 Qc 90
CVE-2026-22542

DENIAL OF SERVICE FOR CONCURRENT CONNECTIONS ON TELNET

An attacker with access to the system's internal network can cause a denial of service on the system by making two concurrent connections through the Telnet service.

CVSS 4.0 · 9.2 Critical EPSS < 1% KEV · Not listed
Vendors
Efacec
Products
Qc 120 Qc 60 Qc 90
CVE-2026-22543

WEEK ENCODING FOR PASSWORDS

The credentials required to access the device's web server are sent in base64 within the HTTP headers. Since base64 is not considered a strong cipher, an attacker could intercept the web request handling the login and obtain the credentials

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Efacec
Products
Qc 120 Qc 60 Qc 90
CVE-2026-22535

FRAIL SECURITY IN MQTT PROTOCOL ALLOWS AN ATTACKER MODIFY CRITICAL PARAMETERS

An attacker with the ability to interact through the network and with access credentials, could, thanks to the unsecured (unencrypted) MQTT communications protocol, write on the server topics of the board that controls the MQTT communications

CVSS 4.0 · 8.9 High EPSS < 1% KEV · Not listed
Vendors
Efacec
Products
Qc 120 Qc 60 Qc 90
CVE-2026-22537

INFORMATION DISCLOSURE WITHIN THE OPERATING SYSTEM

The lack of hardening of the system allows the user used to manage and maintain the charger to consult different files containing clear-text credentials or valuable information for an attacker.

CVSS 4.0 · 6.8 Medium EPSS < 1% KEV · Not listed
Vendors
Efacec
Products
Qc 120 Qc 60 Qc 90
CVE-2023-50703

Cleartext Transmission of Sensitive Information in EFACEC UC 500E

An attacker with network access could perform a man-in-the-middle (MitM) attack and capture sensitive information to gain unauthorized access to the application.

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed
Vendors
Efacec
Products
Uc 500e Uc 500e Firmware
CVE-2023-50707

Uncontrolled Resource Consumption in EFACEC BCU 500

Through the exploitation of active user sessions, an attacker could send custom requests to cause a denial-of-service condition on the device.

CVSS 3.1 · 9.6 Critical EPSS < 1% KEV · Not listed
Vendors
Efacec
Products
Bcu 500 Bcu 500 Firmware
CVE-2023-50705

Exposure of Sensitive Information to an Unauthorized Actor in EFACEC UC 500E

An attacker could create malicious requests to obtain sensitive information about the web server.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Efacec
Products
Uc 500e Uc 500e Firmware
CVE-2023-50704

URL Redirection to Untrusted Site ('Open Redirect') in EFACEC UC 500E

An attacker could construct a URL within the application that causes a redirection to an arbitrary external domain and could be leveraged to facilitate phishing attacks against application users.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Efacec
Products
Uc 500e Uc 500e Firmware