Missing Authentication in CHARX OCPP Agent Service

Due to missing authentication the CHARX OCPP Agent service allows an unauthenticated remote attacker to reconfigure the backend connection. This can lead to Denial-of-Service and confidential data being disclosed to the attacker.

Casky was already ahead

This CVE exploits attack patterns that Casky's 283matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

CVE-2026-44101 exposes a critical authentication bypass in the CHARX OCPP Agent service, allowing unauthenticated remote attackers to reconfigure backend connections without any credentials or validation. This vulnerability carries a CVSS score of 9.8—the highest severity rating—because it requires no user interaction and can be exploited over the network with minimal complexity. Organizations operating EV charging infrastructure, fleet management systems, and energy management platforms relying on CHARX OCPP implementations are directly affected. The impact is severe: attackers can redirect traffic to malicious backends for data exfiltration, disrupt charging operations causing denial-of-service, or intercept sensitive operational data, making this a critical risk for both critical infrastructure and enterprise environments.

Casky's 283 matching skills leverage Claude AI's extended reasoning to detect the attack patterns underlying this vulnerability across MITRE ATT&CK's Initial Access (TA0004) and Credential Access (TA0006) phases. Practitioners using Casky would identify detection signals including unauthenticated API calls to CHARX OCPP endpoints, anomalous backend connection reconfigurations originating from unexpected sources, unusual network traffic patterns toward newly configured backends, and suspicious configuration changes lacking proper authentication logs. The platform's skills would correlate these indicators to CWE-306 (Missing Authentication for Critical Function) patterns, revealing how attackers exploit the absence of authentication checks to pivot into backend systems. Security teams would see findings highlighting network traffic anomalies, unexpected service reconfigurations, and data exfiltration attempts—enabling rapid detection before damage occurs.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

283 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-44101.

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

Access with Stolen Session Cookie

identity access management · low

Run

MITRE ATT&CK Techniques

TA0004 TA0006

Investigate the attack patterns behind CVE-2026-44101

Casky has 283 skills that investigate the attack patterns behind CVE-2026-44101. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn