EUVD-2026-13852
GHSA-3pgw-qmv2-hv8m
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
5DescriptionCVE.org
WebSocket endpoints lack proper authentication mechanisms, enabling attackers to perform unauthorized station impersonation and manipulate data sent to the backend. An unauthenticated attacker can connect to the OCPP WebSocket endpoint using a known or discovered charging station identifier, then issue or receive OCPP commands as a legitimate charger. Given that no authentication is required, this can lead to privilege escalation, unauthorized control of charging infrastructure, and corruption of charging network data reported to the backend.
AnalysisAI
Unauthenticated access to OCPP WebSocket endpoints allows remote attackers to impersonate legitimate charging stations and execute arbitrary commands against electric vehicle charging infrastructure without credentials. An attacker can connect using a known station identifier to manipulate charging operations, alter backend data, and escalate privileges across the charging network. No patch is currently available for this critical vulnerability affecting EV charging systems.
Technical ContextAI
This vulnerability affects the Open Charge Point Protocol (OCPP) WebSocket implementation in IGL Technologies eparking.fi electric vehicle charging management platform (CPE: cpe:2.3:a:igl-technologies:eparking.fi). OCPP is a widely-used protocol for communication between EV charging stations and central management systems. The root cause is CWE-306 (Missing Authentication for Critical Function), where the WebSocket endpoint accepts connections and processes OCPP commands without validating the identity of the connecting client. This allows any network-accessible attacker to establish a WebSocket connection, claim to be a legitimate charging station using a valid or guessed station identifier, and execute charging commands or receive configuration updates intended for authorized infrastructure components.
RemediationAI
Immediately implement WebSocket authentication mechanisms for all OCPP endpoints, requiring mutual TLS authentication or token-based authentication before processing any charging station commands. Consult the CISA ICS advisory at https://www.cisa.gov/news-events/ics-advisories/icsa-26-078-08 for vendor-provided patches or security updates addressing CVE-2026-29796. As interim mitigations until patches can be deployed, restrict network access to OCPP WebSocket endpoints using firewall rules that only permit connections from known charging station IP addresses, implement network segmentation to isolate charging infrastructure from untrusted networks, and deploy intrusion detection systems to monitor for suspicious connection attempts or command patterns. Deploy a reverse proxy or API gateway in front of WebSocket endpoints to enforce authentication policies and rate limiting. Review charging station identifier allocation processes to prevent predictable or enumerable station IDs that facilitate impersonation attacks.
More in Eparking Fi
View allUnlimited authentication attempts against the eParking.fi WebSocket API enable network-based denial-of-service attacks t
A session management vulnerability exists in the WebSocket backend of IGL Technologies' eparking.fi platform that allows
A web-based mapping platform exposes charging station authentication identifiers publicly, allowing unauthenticated netw
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today