CVE-2026-22099

Executive Summary

CVE-2026-22099 is a missing authentication vulnerability in DIVD charging station firmware that allows any attacker within Bluetooth range to send unauthenticated commands to the device. The exposed functionality includes sensitive information leakage, the ability to remotely reboot the charging station, and the capability to push a malicious firmware update URL. With a CVSS score of 8.7 (High), the vulnerability enables complete compromise of the charging station's confidentiality, integrity, and availability with no user interaction or privileges required. The vulnerability is currently unpatched, and no vendor fix or workaround has been published.

Technical Analysis

The root cause of CVE-2026-22099 is the absence of any authentication mechanism for Bluetooth communication channels on the charging station. The NVD description explicitly states: "The charging station does not require authentication for Bluetooth commands to perform actions." This maps directly to CWE-306 (Missing Authentication for Critical Function), indicating that the device fails to verify the identity of the entity sending commands over the Bluetooth interface.

Attack Surface and Mechanism

The Bluetooth interface functions as a management and configuration channel for the charging station. Because no pairing authentication, PIN verification, or session-level encryption is enforced, any Bluetooth-capable device within radio range (~10–100 meters depending on Bluetooth class and environmental conditions) can establish a connection and issue commands.

The NVD description enumerates three distinct categories of exposed functionality:

1. Sensitive Information Leakage — The device responds to commands that disclose configuration data, credentials, or operational telemetry without any verification of the requester's identity. This could include network configuration details, charging session data, or stored user information.

2. Triggering Reboots — An attacker can send a command that initiates a device reboot. This creates a denial-of-service condition that disrupts ongoing charging sessions and prevents legitimate users from utilizing the station.

3. Pushing a Firmware Update URL — The device accepts a firmware update URL over the unauthenticated Bluetooth channel. This is the most severe exposure, as it allows an attacker to point the device to a malicious firmware image that will be fetched and installed, resulting in full persistent compromise of the device.

Why This Is Critical

The Bluetooth interface is designed to be a trusted management channel, but the lack of authentication means the trust boundary is effectively zero. Attackers do not need any prior knowledge, credentials, or physical access to the device enclosure — only proximity to the charging station. The device's implementation fails to enforce mutual authentication, making all three command categories trivially exploitable.

Exploitation Scenarios

The following attack chain describes how an attacker exploits CVE-2026-22099 in a real-world scenario:

1) Reconnaissance and Target Identification

The attacker conducts a Bluetooth discovery sweep in a target area (e.g., a commercial parking garage, public charging plaza, or residential complex). Using standard tools like hcitool scan or bluetoothctl, the attacker identifies Bluetooth devices advertising themselves as charging stations or visible in the BLE/GATT device list. The attacker selects targets based on signal strength and device naming conventions commonly associated with DIVD charging station products.

2) Connection and Command Enumeration

The attacker initiates a Bluetooth connection to the target device. Since no authentication is required, the connection is established immediately without pairing prompts or PIN challenges. The attacker then enumerates the device's service discovery records to identify available command channels. The attacker probes the interface with benign commands to map out which functions are accessible and how the device responds to request framing.

3) Weaponization and Exploitation

The attacker selects the attack vector based on their objective:

Scenario A — Information Theft: The attacker sends commands corresponding to the sensitive information leakage functionality. The device responds with configuration data, potentially including network SSIDs, Wi-Fi passwords, BMS credentials, API keys, or user account details stored on the charging station. This data is captured and used for lateral movement into the charging network's backend infrastructure.

Scenario B — Denial of Service: The attacker sends the reboot command. The device immediately begins a shutdown/power cycle sequence, terminating any active charging sessions. Users attempting to charge their EVs are unable to connect, and the station remains offline until the reboot completes. Repeated reboot commands can keep the station in a perpetual cycle of unavailability.

Scenario C — Firmware Backdoor: The attacker sets up a malicious web server hosting a crafted firmware image containing a backdoor implant. The attacker sends the firmware update URL command, pointing the device to their malicious server. The charging station fetches the firmware, verifies it (or fails to verify it), and flashes the new image. The attacker now has persistent remote control of the charging station, including all charging management functions and the ability to exfiltrate data from future charging sessions.

4) Post-Exploitation Impact

In all scenarios, the attacker gains a foothold on a device that is part of a larger networked infrastructure — charging stations typically report to a central management system via Wi-Fi, Ethernet, or cellular connections. A compromised station can serve as a pivot point to attack the backend management platform, other connected stations, or the charging network's cloud services. The attacker can also manipulate charging session records, causing billing fraud or creating safety hazards by tampering with charging parameters.

Impact Assessment

CVSS Breakdown: The vector CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H indicates:

• Attack Vector: Adjacent Network — the attacker must be in Bluetooth range, but no internet access is needed
• Attack Complexity: Low — no special conditions or race conditions required
• Privileges Required: None — the attack requires zero pre-authentication
• User Interaction: None — no victim action is necessary
• Confidentiality/Integrity/Availability Impact: High — all three are fully compromised

Business Impact:

• Operational disruption: Unauthorized reboots cause downtime and degrade charging service availability
• Data breach: Leaked sensitive information may expose customer PII, network credentials, or financial data from charging sessions
• Reputational damage: Compromise of public charging infrastructure erodes consumer trust in EV adoption and public charging networks
• Safety risk: Tampered firmware could create electrical safety hazards, voltage irregularities, or fire risks at public locations

Blast Radius: Any DIVD charging station with Bluetooth enabled is vulnerable. The attack is limited by physical proximity (Bluetooth range), but in densely populated urban areas, a single attacker can compromise multiple stations within a single sweep. If the charging station's network connectivity is used as a pivot, the blast radius extends to the entire backend management infrastructure.

Detection Guidance

Sigma Rule

title: Bluetooth Unauthenticated Command Execution on Charging Station
id: 5b1f2164-9c3a-4f7b-92de-0c3e4a8b1d44
status: experimental
description: Detects anomalous Bluetooth command sequences targeting charging station management functions without authentication
author: Valtersit Threat Intelligence
date: 2026/01/15
logsource:
  category: application
  product: charging_station
detection:
  selection:
    bluetooth.connection_established: true
    bluetooth.auth_required: false
    event.action:
      - 'firmware_update_request'
      - 'reboot_command'
      - 'info_dump'
  filter_known_ops:
    bluetooth.authenticated_session: true
  condition: selection and not filter_known_ops
level: high
falsepositives:
  - Legitimate maintenance operations performed by authorized technicians
  - Firmware updates initiated through authenticated management channels

YARA Rule

rule Bluetooth_Unauth_Charging_Station_Commands
{
    meta:
        author = "Valtersit Threat Intelligence"
        description = "Detects command payloads targeting CVE-2026-22099 unauthenticated Bluetooth exploitation"
        date = "2026-01-15"
        reference = "CVE-2026-22099"
        severity = "high"
    strings:
        $reboot_cmd = "REBOOT" ascii nocase
        $firmware_url = "FW_URL" ascii nocase wide
        $info_leak = "GET_INFO" ascii nocase
        $update_trigger = "FW_UPDATE" ascii nocase
    condition:
        any of ($reboot_cmd, $firmware_url, $info_leak, $update_trigger) and
        filesize < 1KB
}

Suricata IDS Rule

alert bluetooth any any -> any any (msg:"CVE-2026-22099 - Unauthenticated Bluetooth Command to Charging Station"; flow:to_server; content:"REBOOT"; nocase; classtype:attempted-admin; sid:2026220991; rev:1; metadata:created_at 2026_01_15, updated_at 2026_01_15, cve CVE-2026-22099;)

Elastic Detection

sequence by host.name with maxspan=5s
  [network where event.category == "bluetooth" and event.action == "connection_denied" and network.transport == "bluetooth"]
  [network where event.category == "bluetooth" and event.action == "connection_success" and network.transport == "bluetooth"]
  [process where event.action == "exec_command" and process.command_line like "*firmware*" and process.command_line like "*http*"
   or process.command_line like "*reboot*" and process.command_line like "*bluetooth*"]

Splunk SPL Query

index=bluetooth_logs sourcetype="charging_station:*"
| search "auth_required=false" OR "authentication=NULL" OR "no_auth"
| rename bluetooth.cmd AS command
| eval threat_level=case(
    command=="REBOOT", "HIGH",
    command=="FW_UPDATE", "CRITICAL",
    command=="GET_INFO", "HIGH",
    true(), "OBSERVE"
  )
| table _time, device_id, bluetooth.mac, command, threat_level
| search threat_level IN ("HIGH", "CRITICAL")
| sort - _time

Wazuh OSSEC Rule

<group name="bluetooth,charging_station,">
  <rule id="229901" level="12">
    <if_sid>509</if_sid>
    <match>RX:REBOOT|RX:FW_UPDATE|RX:GET_INFO</match>
    <description>CVE-2026-22099: Unauthenticated Bluetooth command received on charging station - possible exploitation attempt</description>
    <group>bluetooth_security,</group>
    <mitre>
      <id>T1210</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch Confidence: 0/4 — UNPATCHED. No patch evidence exists from any tracked source. The vendor has not released a fix, and no version-specific affected ranges have been published. Therefore, patching is not currently possible.

Immediate Mitigations (until a patch is available):

1. Disable Bluetooth on charging stations — If Bluetooth is not required for core charging functionality, disable the interface entirely via the device's administrative console. This is the most effective immediate action.
2. Restrict physical access — If Bluetooth must remain enabled, limit physical access to the charging station enclosure. Note that the attack is radio-based, so physical access restrictions alone are insufficient.
3. Network segmentation — Ensure charging stations are on isolated network segments with strict firewall rules preventing lateral movement to backend systems if the station is compromised.
4. Continuous monitoring — Implement detection rules (below) to identify unauthenticated Bluetooth connection attempts and alert security teams.

Patch/Upgrade Steps:

Since no patch exists, contact DIVD directly to request an ETA for a firmware fix and apply it immediately upon release. Monitor DIVD's security advisory channel for announcements. When a patch becomes available, verify firmware integrity checksums before deployment and test in a staging environment.

Long-Term Hardening:

1. Require Bluetooth pairing with mandatory authentication — The firmware must implement challenge-response authentication for all Bluetooth connections, including a minimum PIN strength and session encryption.
2. Principle of least privilege — Separate command channels so that information query functions do not expose authentication credentials; separate management functions from user-level operations.
3. Firmware signing verification — Implement cryptographic verification of firmware update images before flashing, preventing malicious URL-based updates from installing untrusted code.
4. Audit logging — Add tamper-evident logging of all Bluetooth commands with timestamp, source MAC, and command type for forensic analysis.
5. Vulnerability disclosure program — Encourage security researchers to report similar flaws through a coordinated disclosure process.

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2026-22099
2. MITRE CWE-306: https://cwe.mitre.org/data/definitions/306.html — Missing Authentication for Critical Function
3. MITRE ATT&CK T1210: https://attack.mitre.org/techniques/T1210/ — Exploitation of Remote Services
4. CISA Known Exploited Vulnerabilities Catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog (CVE-2026-22099 NOT listed — no evidence of in-the-wild exploitation)
5. EPSS Data (FIRST.org): https://www.first.org/epss/ (EPSS score 0.00188, 8.6% percentile — low likelihood of exploitation)

Threat Actor Activity: No known threat actor campaigns or exploit-in-the-wild evidence exist for CVE-2026-22099 as of this report. The public PoC availability indicates the vulnerability is known to the security research community, and exploitation attempts should be expected once devices with default Bluetooth configurations are exposed in areas accessible to malicious actors.