CTEK Chargeportal CVE-2026-31904

Remote unauthenticated exploitation against default configurations of CTEK Chargeportal where the WebSocket API endpoint is network-accessible (AV:N/AC:L/PR:N). No special authentication, user interaction, or non-default settings required to launch denial-of-service attacks. Successful brute-force authentication attacks require that valid user accounts exist with guessable credentials. Exploitation is limited to environments where Chargeportal's WebSocket interface is reachable from the attacker's network position - rate limiting effectiveness depends on whether the platform is internet-facing (higher risk) versus isolated on internal OT networks (lower risk). The CVSS vector confirms no attack complexity barriers beyond basic network connectivity.

Real-world risk assessment reveals moderate priority despite high CVSS 8.7. CVSS vector indicates straightforward remote exploitation (AV:N/AC:L/PR:N/UI:N) with high availability impact (VA:H), consistent with DoS potential. However, EPSS score of 0.08% (23rd percentile) suggests low attacker interest, likely due to the narrow target base (EV charging infrastructure operators using CTEK systems). CISA SSVC framework marks this as automatable with partial technical impact and no confirmed exploitation - indicating theoretical risk rather than imminent threat. The dual-use nature (DoS vs. credential brute-force) creates differing risk profiles: DoS attacks are trivially automatable but only disrupt telemetry visibility rather than compromising chargers themselves; brute-force attacks require valid credentials to exist and weak passwords to succeed. CISA ICS-CERT involvement elevates concern for critical infrastructure operators, but absence from CISA KEV and low EPSS suggest this is not being actively exploited in the wild. Priority should focus on environments where charging infrastructure availability is operationally critical or where weak authentication credentials may exist.

An attacker identifies a CTEK Chargeportal instance exposed to the internet via reconnaissance of charging network infrastructure. They script automated WebSocket connection attempts to the authentication endpoint, flooding the server with thousands of concurrent authentication requests. This exhausts server resources (CPU, memory, connection pools), causing legitimate charger telemetry to be delayed or dropped, creating blind spots in charging network monitoring. Alternatively, the attacker enumerates common usernames and attempts credential brute-forcing with no throttling, potentially gaining administrative access to manage charging infrastructure if weak passwords exist.