CVE-2026-22541
📋 TL;DR
This vulnerability allows attackers to cause a denial of service on EV charger control boards by flooding them with ICMP requests. When exploited, the affected board becomes unresponsive, preventing the EV charger from functioning properly. This affects EV charger systems using vulnerable control boards.
💻 Affected Systems
- EV charger control boards from Thales
⚠️ Manual Verification Required
This CVE does not have specific version information in our database, so automatic vulnerability detection cannot determine if your system is affected.
Why? The CVE database entry doesn't specify which versions are vulnerable (no version ranges provided by the vendor/NVD).
🔒 Custom verification scripts are available for registered users. Sign up free to download automated test scripts.
- Review the CVE details at NVD
- Check vendor security advisories for your specific version
- Test if the vulnerability is exploitable in your environment
- Consider updating to the latest version as a precaution
⚠️ Risk & Real-World Impact
Worst Case
Complete EV charger failure, preventing vehicle charging and potentially disrupting charging station operations.
Likely Case
Temporary charger unavailability requiring manual reset or intervention.
If Mitigated
Minimal impact with proper network segmentation and rate limiting in place.
🎯 Exploit Status
ICMP flooding is a well-known attack technique requiring minimal technical skill.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: https://cds.thalesgroup.com/en
Restart Required: No
Instructions:
Check Thales security advisory for specific patching instructions when available.
🔧 Temporary Workarounds
Network segmentation and filtering
allIsolate EV charger control boards from untrusted networks and implement ICMP rate limiting
Firewall ICMP restrictions
linuxBlock or limit ICMP traffic to EV charger control interfaces
iptables -A INPUT -p icmp --icmp-type echo-request -m limit --limit 1/second -j ACCEPT
iptables -A INPUT -p icmp --icmp-type echo-request -j DROP
🧯 If You Can't Patch
- Implement network segmentation to isolate charger control systems
- Deploy network monitoring and alerting for ICMP flood patterns
🔍 How to Verify
Check if Vulnerable:
Test if ICMP flooding causes board unresponsiveness in controlled environmentCheck Version:
Check board firmware version via manufacturer documentationVerify Fix Applied:
Verify ICMP flood no longer causes service disruption after implementing controls📡 Detection & Monitoring
Log Indicators:
- High volume of ICMP requests to charger control interfaces
- Board reset or service interruption logs
Network Indicators:
- Unusually high ICMP traffic to charger control IPs
- Pattern of ICMP floods from single sources
SIEM Query:
source_ip=* AND protocol=icmp AND dest_ip=charger_control_ip AND count>1000 per minute