SECURITY ADVISORY · DEVLINK-SA-2026-001
OpenSSL update in
ChargeLink Admin.
ChargeLink Admin 1.0.3 replaces the bundled OpenSSL 3.5.6 with 3.5.9. Two low-severity OpenSSL issues could be reached in 1.0.0 by displaying a crafted certificate file.
How to update ↓CSAF 2.0 (JSON) ↗At a glance.
- Severity
- Low
- CVE
- CVE-2026-34180 · CVE-2026-7383
- Actively exploited
- No known exploitation
- Published
- Affected
- ChargeLink Admin 1.0.0
- Fixed
- ChargeLink Admin 1.0.3
AFFECTED PRODUCTS
Who needs to update.
| Product | Affected versions | Fixed version |
|---|---|---|
| ChargeLink Admin (Windows installer) | 1.0.0 | 1.0.3 first fixed in 1.0.1; 1.0.1 and 1.0.2 were not distributed |
DESCRIPTION & IMPACT
What happened.
What it means.
Description
ChargeLink Admin 1.0.0 bundled OpenSSL 3.5.6 for certificate generation. OpenSSL 3.5.7 and 3.5.8 fix 25 vulnerabilities.
ChargeLink Admin uses OpenSSL only to create certificates and to display certificate files. Through that use, two low-severity issues in ASN.1 parsing can be reached: CVE-2026-34180 (heap over-read) and CVE-2026-7383 (multibyte string conversion). The other issues affect OpenSSL features that ChargeLink Admin does not use, including the high-severity CVE-2026-45447 in PKCS7_verify.
Impact
Someone who can get an operator to import a crafted certificate file may cause the short-lived OpenSSL process that displays it to read out of bounds or crash. The console, its data and the ChargeLink engine are not affected.
REMEDIATION
Update to
ChargeLink Admin 1.0.3.
It bundles OpenSSL 3.5.9, built from the official source release, and Node.js 24.21.0. The installer and the program are signed by DEVlink AB. This is a security-only update: it is free of charge and runs under every licence that covers 1.0.0, including perpetual licences without maintenance.
ChargeLinkAdminSetup-1.0.3.exe SHA-256:4C5778D0FE60B43F78021F680592BB52864B554FE1C93AFA1A20C2A7BAE26391- Until you update: import certificates only from trusted sources.
- Check the installed version in Windows Settings → Apps → Installed apps. After the update, ChargeLink Admin shows version 1.0.3. Windows shows DEVlink AB as the verified publisher of the installer.
Since 1.0.2, the bundled openssl.exe has gone from 3.5.8 to 3.5.9, which fixes CVE-2026-35189 (Low) for the OpenSSL command-line tool. The same issue remains in the OpenSSL that is built into Node.js 24.21.0; a separate advisory follows when a Node.js release that fixes it is shipped.
CONTACT
Questions about this advisory?
Report security issues to security@devlink.se. Revision 3, 12 October 2026.