Chargeportal CVE-2026-27649

Remote unauthenticated attacker can exploit the WebSocket backend by connecting with predictable or known charging station identifiers. No victim interaction required. Affects systems using the vulnerable WebSocket charging station backend with default session identifier generation. The attacker's most recent connection displaces the legitimate station.

The CVSS v3.1 score of 7.3 reflects a remotely exploitable vulnerability (AV:N) with low attack complexity (AC:L) requiring no privileges (PR:N) or user interaction (UI:N), resulting in partial impacts across confidentiality, integrity, and availability (C:L/I:L/A:L). The network-accessible nature and authentication bypass potential make this particularly concerning for industrial control systems in the electric vehicle charging infrastructure sector. While no EPSS score or KEV listing indicates current exploitation activity, the ICS-CERT advisory publication signals government concern about operational technology impacts. The combination of no privileges required and low complexity makes this highly automatable for mass scanning, though the specialized nature of charging station infrastructure limits the attack surface to environments with CTEK ChargePortal deployments. Real-world risk is elevated for organizations in the EV charging sector due to potential service disruption and command interception affecting physical infrastructure.

An attacker scans for exposed CTEK ChargePortal WebSocket endpoints and enumerates predictable charging station identifiers through reconnaissance or brute force. The attacker then initiates a WebSocket connection using a legitimate station's identifier, displacing the actual charging station and receiving all backend commands intended for that station, including configuration changes, charging authorizations, and payment processing instructions. By repeatedly connecting with multiple station identifiers, the attacker can create a denial-of-service condition preventing legitimate stations from maintaining stable connections while potentially harvesting sensitive operational data or manipulating charging operations.