Unauthenticated Reconfiguration of EV Charging Infrastructure

The CHARX JupiCore service allows an unauthenticated remote attacker to reconfigure charging points. This can lead to disclosure of charging point UIDs, Denial-of-Service and files tampering.

Casky was already ahead

This CVE exploits attack patterns that Casky's 283matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

CVE-2026-44100 represents a critical vulnerability in the CHARX JupiCore charging point management service that allows unauthenticated remote attackers to reconfigure active charging infrastructure. With a CVSS score of 9.4, this weakness stems from missing authentication controls (CWE-306) and exposes a fundamental gap in API security across the electric vehicle charging ecosystem. Organizations operating charging networks, fleet managers, and infrastructure providers face immediate risks including exposure of sensitive charging point identifiers, service disruption affecting end users, and potential tampering with charging configurations that could impact grid stability or customer data.

Casky's 283 mapped skills leverage Claude AI's extended reasoning to detect the attack patterns underlying this vulnerability by correlating initial access techniques (TA0004) and credential access methods (TA0006) with observed reconnaissance and exploitation behaviors. Practitioners using Casky would identify findings indicating unauthenticated HTTP/REST API calls to JupiCore endpoints, detection of configuration change attempts without valid authentication tokens, and anomalous reconfiguration requests originating from unexpected network sources. The platform's skill set helps security teams recognize the absence of proper API authentication enforcement, detect lateral movement attempts through charging point networks, and identify indicators of both active reconnaissance and exploitation attempts before damage occurs.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

283 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-44100.

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

Access with Stolen Session Cookie

identity access management · low

Run

MITRE ATT&CK Techniques

TA0004 TA0006

Investigate the attack patterns behind CVE-2026-44100

Casky has 283 skills that investigate the attack patterns behind CVE-2026-44100. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn