THREAT INTELLIGENCE REPORT — CVE-2026-22100

Classification: UNPATCHED — Critical Command Injection in OCPP ReserveLogin Message
Report Date: Analysis current as of the latest available threat data
Prepared By: Valters IT Security Research
Document Classification: TLP:CLEAR

Executive Summary

CVE-2026-22100 is a critical command injection vulnerability in the OCPP (Open Charge Point Protocol) DataTransfer message handler for the ReserveLogin operation. An unauthenticated remote attacker can inject arbitrary OS commands through the message's data value, resulting in full root-level code execution on the affected charging station or central management system. The vulnerability is confirmed as unpatched (patch confidence 0/4), with no vendor fix, workaround, or advisory available from any tracked source. Given the CVSS score of 8.6 (High) and the root-level execution capability, this flaw represents an immediate and severe risk to EV charging infrastructure deployed exposed to untrusted networks.

The affected product is attributed to vendor DIVD, though no specific product line, version range, or distribution details are confirmed in available intelligence. Any OCPP implementation that processes ReserveLogin DataTransfer messages without proper input sanitization should be considered vulnerable.

Technical Analysis

The vulnerability resides in the OCPP DataTransfer message framework, specifically within the handling of the ReserveLogin vendor-specific operation. OCPP (Open Charge Point Protocol) is the de facto standard communication protocol between EV charging stations and central management systems (CSMS), operating over WebSocket or HTTP, typically on ports 80, 443, or 8080. The DataTransfer message is an optional, extensible mechanism defined by the OCPP specification to allow vendor-specific or manufacturer-specific functionality beyond the core protocol operations.

The attack mechanics are straightforward but devastating:

1. Protocol Entry Point: The attacker sends a DataTransfer request to the OCPP endpoint. The message structure contains three primary fields: vendorId (identifying the vendor extension), messageId (which in this case is ReserveLogin), and data (a free-form string field used to carry vendor-defined payloads).

2. Vulnerable Processing: When the OCPP stack receives a DataTransfer message with messageId set to ReserveLogin, it passes the data field into a command execution context — likely a system shell invocation, subprocess call, or similar OS-level execution routine. The application fails to sanitize or validate the content of this data field before including it in the executed command.

3. Injection Vector: An attacker crafts the data value to contain shell metacharacters (e.g., ;, |, &&, backticks, or command substitution syntax) followed by arbitrary OS commands. For example, appending ; id to a legitimate value would execute the id command after the intended operation completes.

4. Execution Context: The NVD description explicitly states commands execute as root, meaning the vulnerable service runs with superuser privileges. This elevates the impact from a service account compromise to full system compromise with no privilege escalation required.

The lack of any version information (Affected Versions: []) and absence of vendor documentation suggests this may be a 0-day vulnerability — either recently discovered through responsible disclosure without public acknowledgment, or found in the wild without coordination. The OCPP protocol's widespread adoption across EV charging infrastructure means any charging network operator, fleet management system, or home charger communicating via OCPP is theoretically exposed if they enable the DataTransfer extension that processes ReserveLogin.

Attack surface analysis: The vulnerability is network-exploitable (AV:N per CVSS vector), requiring no authentication (PR:N), and no user interaction (UI:N). The initial access vector is the OCPP WebSocket/HTTP endpoint itself — there is no need for the attacker to first compromise credentials, physical access, or a separate foothold. Any charging station or CSMS with an internet-reachable OCPP port is directly targeted.

Exploitation Scenarios

Scenario 1: Unauthenticated Remote Takeover of a Public Charging Station

Reconnaissance (Step 1): The attacker first identifies exposed OCPP endpoints. Using network scanning tools (e.g., Shodan, Censys, masscan), they search for IoT/EV-charger device fingerprints, OCPP WebSocket handshake signatures, or common charging-station management ports (80, 443, 8080). The Shodan dorks listed in Metadata facilitate this discovery. The attacker looks for responses indicating an OCPP central system or station accepting WebSocket upgrades.

Trigger/Weaponization (Step 2): The attacker establishes a WebSocket connection to the identified OCPP endpoint. OCPP messages are JSON-formatted over the WebSocket. The attacker crafts the following malicious DataTransfer message:

{
  "vendorId": "DIVD",
  "messageId": "ReserveLogin",
  "data": "test; id; whoami; cat /etc/shadow"
}

The data field contains the injection payload. The attacker may include URL-encoding or JSON string escaping to obfuscate the shell metacharacters, but the core attack is a simple semicolon-delimited command append. The messageId field must be exactly ReserveLogin to trigger the vulnerable code path.

Payload Execution (Step 3): The OCPP server receives the message, validates only the messageId field type (not its content), and passes the raw data string to the OS command execution routine. The intended command might be something like reserve_user <data> or a similar concatenation. When processed, the shell interprets test; id; whoami; cat /etc/shadow as four sequential commands. Assuming the vulnerable app runs as root (per NVD description), the id command confirms root privileges, whoami returns root, and cat /etc/shadow extracts password hashes.

Post-Exploitation (Step 4): With root access, the attacker achieves complete control. They can:

• Install persistent backdoors (e.g., modify startup scripts, add SSH keys to /root/.ssh/authorized_keys, deploy a rootkit)
• Exfiltrate sensitive data — charging session logs, user PII stored on the station, firmware images
• Disable the charging station (DoS) or manipulate charging operations (fraud, free charging, grid destabilization via coordinated load manipulation)
• Pivot to the internal network: many charging aggregators connect hundreds of stations to a central management backend. The compromised station becomes a beachhead to attack the CSMS or corporate network
• Brick the device by writing corrupted firmware to flash memory

Scenario 2: Central Management System (CSMS) Compromise

The same vulnerability applies to the server-side OCPP implementation. A charging network operator runs a central server that receives DataTransfer messages from many stations. An attacker who controls any malicious station (or impersonates a legitimate station's identity) sends the crafted ReserveLogin message to the CSMS. Since the description indicates the DataTransfer handler is vulnerable regardless of direction, the CSMS also executes commands as root. This scenario yields even greater blast radius: a single injection compromises the entire charging network's management plane, enabling mass manipulation of hundreds of stations, access to billing data for all customers, and a lucrative ransomware target.

Scenario 3: Supply-Chain / Malicious Station Injection

An attacker who can intercept the OCPP communication path (e.g., via compromised TLS certificate, network MITM on an insecure deployment, or by registering as a rogue charging station in a network) sends the malicious DataTransfer message during the standard station-to-CSMS handshake. This requires no prior authentication if the OCPP endpoint permits unauthenticated DataTransfer messages, which is common in protocol implementations that treat the exchange channel as trusted.

Impact Assessment

Business Impact: The vulnerability enables complete remote compromise of EV charging infrastructure at root privilege. The realistic consequences are:

• Financial fraud: Manipulating charging sessions to avoid billing, reselling charging services, or altering tariff calculations. A compromised CSMS could issue fraudulent chargebacks or provide free charging across an entire network.
• Operational disruption: An attacker can brick charging stations (DoS by firmware corruption), disabling fleet operations, public charging networks, and private charging for organizations that depend on EV fleets.
• Regulatory and legal exposure: Under GDPR and similar data-protection regulations, a breach exposing customer PII (name, credit card details, charging history) triggers mandatory disclosure and potential fines. EV charging networks are frequently classified as critical infrastructure in the EU and several US states.
• Grid instability: Coordinated compromise of many charging stations could manipulate load to cause local grid overloads or destabilize frequency regulation in energy markets.
• Lateral movement: Root access on a station or CSMS provides a trusted network foothold to pivot toward corporate backends, billing systems, and cloud infrastructure.

CVSS Assessment (score 8.6): The vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) reflects unauthenticated network exploitation with no user interaction, yielding high confidentiality, integrity, and availability impact within a single security scope. The unpatched status elevates the real-world risk above the raw score — there is currently no defense available at the software level.

Blast Radius: Global EV charging infrastructure running OCPP. This includes public fast-charging networks (e.g., urban charging hubs), workplace chargers, residential smart chargers with central connectivity, and fleet depot charging systems. Given the limited version data, the affected population is all OCPP implementations processing ReserveLogin DataTransfer messages — potentially thousands of devices per operator.

CISA KEV Status: Not listed in the Known Exploited Vulnerabilities catalog at this time, but the unpatched critical status makes inclusion likely if exploitation emerges.

Detection Guidance

Sigma Rule

title: OCPP ReserveLogin DataTransfer Command Injection Attempt
id: 8f3c2a1e-4b6d-4f8a-9c1e-2d4b6f8a0c1e
status: experimental
description: Detects OCPP DataTransfer messages with messageId ReserveLogin containing shell metacharacters indicating command injection.
logsource:
  category: webserver
  product: ocpp
detection:
  selection_messageid:
    - 'json.messageId': 'ReserveLogin'
    - 'json.data.messageId': 'ReserveLogin'
  selection_payload:
    - 'json.data.data': '*;*'
    - 'json.data.data': '*|*'
    - 'json.data.data': '*&&*'
    - 'json.data.data': '*||*'
    - 'json.data.data': '*\`*'
    - 'json.data.data': '*$(**'
  condition: selection_messageid and selection_payload
falsepositives:
  - Legitimate vendorId-specific DataTransfer payloads that legitimately contain semicolons (rare)
level: high

YARA Rule

rule OCPP_ReserveLogin_Command_Injection {
    meta:
        author = "Valters IT Security Research"
        description = "Detects OCPP DataTransfer ReserveLogin messages containing command injection patterns"
        cve = "CVE-2026-22100"
    strings:
        $msgid = /("messageId"\s*:\s*"ReserveLogin")/ nocase
        $semicolon = /data"\s*:\s*"[^"]*;[ \t]*(id|cat|ls|uname|whoami|wget|curl|sh|bash|nc|python)/ nocase
        $pipe = /data"\s*:\s*"[^"]*\|[ \t]*(id|cat|ls|uname|whoami|wget|curl|sh|bash|nc|python)/ nocase
        $andand = /data"\s*:\s*"[^"]*&&[ \t]*(id|cat|ls|uname|whoami|wget|curl|sh|bash|nc|python)/ nocase
        $dollar = /data"\s*:\s*"[^"]*\$(\(|[A-Z_]+[)|])/ nocase
    condition:
        $msgid and (any of ($semicolon, $pipe, $andand, $dollar))
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-22100 OCPP ReserveLogin Command Injection Detected"; flow:established,to_server; content:"ReserveLogin"; http_client_body; content:"DataTransfer"; http_client_body; pcre:"/\"data\"\s*:\s*\"[^\"]*(\;|\||&&|\|\||\$\(|\`)/Ui"; classtype:attempted-admin; sid:2026221001; rev:1;)

Explanation: This rule inspects HTTP requests containing the OCPP DataTransfer message with ReserveLogin messageId and a data field containing shell metacharacters. The PCRE pattern matches semicolons, pipes, logical ANDs, command substitution, or backticks within the JSON data value.

Elastic Detection

sequence by source.ip, destination.ip with maxspan=10s
  [web where http.request.body.text contains "ReserveLogin" and http.request.body.text contains "\"data\""]
  [process where event.action == "exec" and user.name == "root" and (
      process.command_line regex~ ".*\\;.*(id|cat|whoami|uname|ls).*" or
      process.command_line regex~ ".*\\$\\(.*).*" or
      process.command_line regex~ ".*\\|.*(sh|bash|nc).*" or
      process.command_line regex~ ".*\\&\\&.*(wget|curl|python).*"
  )]

Splunk SPL Query

index=* sourcetype=webserver OR sourcetype=json
| where _raw LIKE "%ReserveLogin%"
| where _raw LIKE "%DataTransfer%"
| regex _raw="\"data\"\s*:\s*\"[^\"]*(\;|\||&&|\||\$\(|\`)"
| table _time, src_ip, dest_ip, uri_path, _raw
| rename _raw as detonation_payload

Wazuh OSSEC Rule

<rule id="100221" level="12">
  <decoded>json</decoded>
  <field name="messageId">ReserveLogin</field>
  <field name="messageId">DataTransfer</field>
  <regex>(\;|\||\&\&|\|\(|\`)</regex>
  <description>CVE-2026-22100: OCPP ReserveLogin command injection attempt detected</description>
  <group>cve-2026-22100,command_injection,ocpp,</group>
</rule>

Mitigation & Patch Guidance

PATCH STATUS: UNPATCHED (Confidence: 0/4) — No vendor advisory, no patched version, no fix committed upstream. The following guidance reflects best-effort hardening in the absence of a vendor solution.

1. Immediate Mitigations (reduce attack surface while waiting for a fix):

• Network segmentation: Place OCPP endpoints (both stations and central servers) on isolated, firewalled network segments. Do not expose OCPP ports (80, 443, 8080) to the public internet. Use VPN or private VLANs for station-to-CSMS communication. Block inbound traffic to these ports from untrusted source IPs.
• Access control: If the OCPP deployment supports TLS client certificates, enforce mutual TLS (mTLS) — require each station to present a valid certificate before establishing the WebSocket/HTTP channel. This prevents unauthenticated attackers from sending crafted DataTransfer messages.
• Disable the ReserveLogin DataTransfer handler: If the OCPP stack supports configuration to disable unknown or vendor-specific DataTransfer messages, enable this restriction. Some stacks offer an allowlist of accepted messageId values; if ReserveLogin is unused by your business logic, block it wholesale.
• Web Application Firewall (WAF): Deploy a WAF in front of the OCPP endpoint with the Suricata rule or a custom rule to block requests containing shell metacharacters in JSON data fields.
• Runtime defense: Harden the OS environment of the OCPP process — run the service with a non-root user (reduce privilege of the process, even if the advisory states it runs as root), use read-only filesystem overlays, and disable unnecessary shell access.

2. Patch/Upgrade Steps:

• Track vendor communication channels: Monitor any DIVD security advisories, product release notes, or notifications through your supplier procurement channel. There is no patch available as of this writing; any claim of a fix should be independently verified against the CVE's patch-status databases.
• Monitor NVD and vendor advisories daily: Re-check https://nvd.nist.gov/vuln/detail/CVE-2026-22100 and DIVD's advisory feed for updates.
• Prepare a patch deployment plan: Have a tested rollback strategy and validation playbook ready so that when a fix ships, you can deploy and verify it within hours, not days.

3. Long-Term Hardening:

• Input validation: Implement strict whitelist validation for all OCPP DataTransfer data fields — reject any payload containing shell metacharacters (;, |, &, $, \, \n`).
• Command execution architecture: Refactor the software to avoid shell invocation entirely. Use parameterized subprocess calls without shell interpretation, or use a safer high-level API for any required OS operations.
• Least privilege: Ensure the OCPP service never runs as root. Use a dedicated low-privileged service account with only the minimal capabilities needed.
• Protocol version upgrade: Evaluate migrating to OCPP 2.0.1 or later, which includes improved message validation and security features. However, verify the specific implementation of DataTransfer handling in the upgraded version before deployment.
• Security monitoring: Implement the detection rules above in your SIEM (Elastic, Splunk, Wazuh) and network IDS/IPS. Enable audit logging at the WebSocket layer to capture OCPP message payloads for forensic analysis.
• Vulnerability management: Add this CVE to your automated scanning. Re-scan all OCPP devices quarterly or after any firmware update to verify no regression.

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2026-22100 — Primary vulnerability record; CNA title confirms command injection in OCPP ReserveLogin DataTransfer message; CVSS 8.6.
2. CISA Known Exploited Vulnerabilities Catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog — CVE-2026-22100 is not currently listed (KEV status: NO). Re-check periodically for exploitation-in-the-wild updates.
3. Open Charge Alliance — OCPP Specification: https://www.openchargealliance.org/protocols/ocpp-json/ — Reference implementation and protocol documentation for the OCPP DataTransfer message structure used in attack construction.
4. Shodan Search for OCPP-Exposed Devices: https://www.shodan.io/search?query=OCPP — References the attack surface prevalence of internet-exposed OCPP endpoints.
5. DIVD (Dutch Institute for Vulnerability Disclosure) Advisory Channel: https://www.divd.nl/ — Monitor for potential coordinated disclosure or advisory if/when the vendor allocates a fix.

Threat Actor Activity: No public exploit-in-the-wild campaigns, weaponized PoC, or Nuclei template are currently known for this CVE. However, given the critical CVSS score, the unpatched status, and the prevalence of internet-facing OCPP devices, exploitation attempts are likely to emerge quickly once a working PoC circulates. The vulnerability aligns with patterns of recent IoT/OT attacks targeting critical infrastructure (e.g., Mirai variants, specialized charger exploits). Organizations should treat this as a high-priority triage item and actively hunt for anomalous OCPP messages in their logs.

This report is based on the NVD description available for CVE-2026-22100. MITRE Tactic, CWE-ID, and CVSS vector parameters are inferred where not explicitly provided, in accordance with best-practice analysis of the stated vulnerability class. All detection rules are provided as detection-related guidance and should be tuned to the specific environment.