ePower.ie CVE-2026-22552

Exploitation requires only network reachability to the ePower.ie OCPP WebSocket endpoint (typically HTTP/HTTPS with WebSocket upgrade on standard ports 80/443) and knowledge of at least one valid charging station identifier used in the target network. Station identifiers may be discoverable through physical inspection of charging equipment, enumeration of predictable naming patterns (sequential numbers, location codes), or observation of legitimate OCPP traffic if network access is available. No user authentication, privileged access, or special software deployment is required - attackers can exploit using standard WebSocket client libraries available in any programming language. Default configurations are vulnerable as the authentication mechanism is entirely absent rather than misconfigured. No user interaction is necessary (UI:N), and exploitation succeeds against any network-accessible instance. The primary limiting factor is that attackers must specifically target EV charging infrastructure and understand OCPP message structure, reducing opportunistic mass-exploitation but not preventing targeted attacks against known ePower.ie deployments.

Real-world risk is HIGH for organizations operating ePower.ie charging infrastructure despite moderate EPSS score. The CVSS 4.0 score of 9.3 with network vector, low complexity, and no prerequisites (AV:N/AC:L/AT:N/PR:N/UI:N) indicates trivial exploitation against exposed endpoints. However, EPSS at 0.12% (31st percentile) suggests mass-scanning exploitation is unlikely, likely because attackers must specifically target EV charging networks and possess OCPP protocol knowledge. The CISA ICS-CERT advisory publication signals government recognition of critical infrastructure risk. No KEV listing indicates active exploitation is not confirmed, though 'Privilege Escalation' and 'Authentication Bypass' tags confirm the attack primitive. Primary risk scenarios: financial fraud through billing manipulation, grid stability impact via coordinated load manipulation, and competitive intelligence theft from charging usage patterns. The low availability impact (VA:L) suggests denial-of-service is not the primary concern - integrity compromise of charging data and unauthorized station control pose greater operational risks. Organizations should prioritize remediation based on external exposure of WebSocket endpoints rather than relying on low EPSS to deprioritize.

An attacker scans internet-exposed IP ranges for WebSocket endpoints responding to OCPP handshake requests, identifying an ePower.ie installation. Using publicly available OCPP protocol documentation, the attacker crafts a WebSocket connection with a guessed or previously observed charging station identifier (often predictable formats like 'STATION001'). The backend accepts the connection without credential verification. The attacker then sends OCPP BootNotification and StatusNotification messages, successfully registering as a legitimate station. From this position, they issue StartTransaction commands to generate fraudulent billing records, send MeterValues messages with manipulated energy consumption data to inflate costs, or transmit StopTransaction messages to prematurely terminate legitimate charging sessions. If many stations are impersonated simultaneously, coordinated power draw manipulation could impact grid load forecasting.