ePower.ie CVE-2026-27778

Remote unauthenticated exploitation against default configurations of ePower.ie charging management systems with internet-accessible WebSocket API endpoints. No special conditions required - the CVSS vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms network-based attacks with low complexity and zero authentication prerequisites succeed against standard deployments. Exploitation effectiveness is limited only by network bandwidth for DoS attacks, and by target password complexity for brute-force attacks. Organizations that have restricted WebSocket API access to internal networks or VPN-only connections are not vulnerable to remote internet-based attacks but remain exposed to insider threats or attackers with existing network footholds. The vulnerability equally affects cloud-hosted and on-premises deployments if the API is network-accessible.

Real-world risk assessment reveals moderate-to-high operational impact but limited immediate exploitation likelihood based on multi-source analysis. CVSS 4.0 score of 8.7 reflects high availability impact (VA:H) from DoS potential, combined with network accessibility and zero authentication requirements (AV:N/PR:N/UI:N). However, EPSS probability of 0.07% (21st percentile) indicates the security community assesses low likelihood of mass exploitation, likely due to the specialized ICS/EV charging sector target profile. CISA ICS-CERT reporting (ics-cert@hq.dhs.gov) and advisory publication elevate priority for critical infrastructure operators. No CISA KEV listing confirms no confirmed active exploitation at time of analysis. No public POC identified. The dual attack vectors (availability via DoS, confidentiality via brute-force) create different risk profiles: DoS attacks are trivial to execute (AC:L) and immediately disruptive to charging operations, while successful brute-force depends on password complexity and detection capabilities. For EV charging operators, availability disruption presents immediate business impact through revenue loss and customer service degradation. Authentication bypass could enable attackers to manipulate charging rates, redirect payments, or disrupt grid load balancing. SSVC framework assessment: exploitation status is none, automatable is yes (simple flood attacks), technical impact is partial (availability primarily). Priority should be HIGH for organizations operating ePower.ie in production charging networks, MEDIUM for pilot deployments with network isolation.

An attacker identifies an internet-exposed ePower.ie charging network management interface through Shodan or similar reconnaissance. Using a simple Python script with the websocket-client library, they open thousands of concurrent WebSocket connections to the authentication endpoint, submitting randomized credentials from common password lists. The lack of rate limiting allows 100+ authentication attempts per second per connection. Within hours, either the WebSocket service exhausts memory resources and crashes (denying legitimate charger telemetry), or the attacker successfully guesses weak credentials for an administrative account, gaining access to charging station controls and billing data. No public POC exists, but the attack is trivial to develop given the straightforward nature of WebSocket brute-forcing without rate limits.