Which versions of CTEK Chargeportal are affected by EUVD-2026-13846?

CVE-2026-25192 is a critical authentication bypass in CTEK Chargeportal's OCPP WebSocket endpoints that allows unauthenticated remote attackers to impersonate charging stations and execute fraudulent…

How to fix or mitigate EUVD-2026-13846?

24 hours: Isolate all CTEK Chargeportal systems from untrusted networks; enable network-based access controls restricting OCPP WebSocket connections to known, authorized station identifiers only; begin inventory of all active charging stations and connected devices. 7 days: Deploy network segmentation placing Chargeportal infrastructure on a restricted VLAN; implement enhanced logging and alerting for WebSocket connection attempts with anomalous station identifiers; conduct forensic review of connection logs for indicators of unauthorized access. 30 days: Contact CTEK for remediation timeline and interim security controls; evaluate alternative charging management platforms; perform full network penetration test focusing on OCPP endpoint security; develop incident response procedures specific to charging network compromise.

CTEK Chargeportal EUVD-2026-13846

Q: What is the CVSS score of EUVD-2026-13846?

EUVD-2026-13846 has a CVSS 4.0 base score of 9.3 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

| CVE-2026-25192 CRITICAL

Missing Authentication for Critical Function (CWE-306)

2026-03-20 icscert

Authentication Bypass Privilege Escalation Chargeportal Ctek

9.3

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

9.3 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Updated

May 06, 2026 - 15:27 vuln.today

v2 (cvss_changed)

Re-analysis Queued

May 06, 2026 - 15:22 vuln.today

cvss_changed

CVSS changed

May 06, 2026 - 15:22 NVD

9.4 (CRITICAL) 9.3 (CRITICAL)

EUVD ID Assigned

Mar 20, 2026 - 23:01 euvd

EUVD-2026-13846

Analysis Generated

Mar 20, 2026 - 23:01 vuln.today

CVE Published

Mar 20, 2026 - 22:42 nvd

CRITICAL 9.4

DescriptionCVE.org

WebSocket endpoints lack proper authentication mechanisms, enabling attackers to perform unauthorized station impersonation and manipulate data sent to the backend. An unauthenticated attacker can connect to the OCPP WebSocket endpoint using a known or discovered charging station identifier, then issue or receive OCPP commands as a legitimate charger. Given that no authentication is required, this can lead to privilege escalation, unauthorized control of charging infrastructure, and corruption of charging network data reported to the backend.

AnalysisAI

CTEK Chargeportal's OCPP WebSocket endpoints accept unauthenticated connections, allowing remote attackers to impersonate charging stations by connecting with known or discovered station identifiers and issuing fraudulent OCPP commands to the backend infrastructure. This authentication bypass enables complete control over charging operations, data manipulation, and privilege escalation across the charging network. CISA ICS-CERT issued advisory ICSA-26-078-06 for this industrial control system vulnerability. EPSS score of 0.13% (33rd percentile) indicates relatively low predicted exploitation likelihood despite critical CVSS 9.3 severity, though SSVC assessment confirms the vulnerability is fully automatable with total technical impact.

Technical ContextAI

OCPP (Open Charge Point Protocol) is a standardized WebSocket-based protocol used for communication between electric vehicle charging stations and central management systems. The vulnerability stems from CWE-306 (Missing Authentication for Critical Function), where the WebSocket endpoints implementing OCPP communication lack any authentication layer. This allows arbitrary connections to masquerade as legitimate charging infrastructure by simply knowing or enumerating valid charging station identifiers. The affected product CTEK Chargeportal (CPE: cpe:2.3:a:ctek:chargeportal:*:*:*:*:*:*:*:*) serves as the backend management platform for electric vehicle charging networks, making this authentication gap particularly severe for critical infrastructure operators managing fleet charging operations.

RemediationAI

Immediately contact CTEK support at https://www.ctek.com/support to obtain patching guidance and version upgrade information, as vendor advisory details are not publicly specified in available references. Until vendor patches are deployed, implement network-level compensating controls: (1) Place Chargeportal WebSocket endpoints behind VPN or private network segments accessible only to legitimate charging station IP ranges-this breaks the AV:N vector but requires maintaining accurate IP allowlists and may complicate mobile/distributed charger deployments. (2) Deploy layer-7 firewall or API gateway to enforce mutual TLS certificate authentication for WebSocket connections, verifying charging station identity cryptographically-this requires certificate provisioning infrastructure and charger reconfiguration but provides strong authentication. (3) Implement network monitoring to detect anomalous OCPP WebSocket connection patterns (unexpected station IDs, command sequences, geographic origins)-this is detective not preventive and generates alert fatigue without careful tuning. Refer to CISA advisory ICSA-26-078-06 for government-issued mitigation guidance specific to industrial control environments. Note that network isolation may conflict with cloud-based charging management models and certificate-based authentication requires compatible charger firmware.