CTEK Chargeportal EUVD-2026-13846

No special conditions-remote unauthenticated exploitation against default configurations of CTEK Chargeportal. The CVSS vector AV:N/AC:L/PR:N/UI:N confirms network-accessible attack requiring no privileges, low complexity, and no user interaction. Only prerequisite is network reachability to the OCPP WebSocket endpoints, which are inherently designed for external charging station connectivity. Attackers need knowledge or discovery of valid charging station identifiers to impersonate specific devices, but identifier enumeration is feasible through observation of public charging locations, brute-force of sequential patterns, or information disclosure from other vulnerabilities. No authentication mechanisms, special permissions, or non-default configurations limit exploitation. However, practical attack impact is bounded by whether the deployment exposes WebSocket endpoints to the public internet versus restricting to private networks-operators using VPN or network segmentation already mitigate the AV:N vector despite the product's inherent lack of authentication.

This vulnerability presents a complex risk profile requiring nuanced assessment across multiple signals. CVSS 4.0 score of 9.3 with vector AV:N/AC:L/PR:N/UI:N indicates maximum exploitability-network-accessible, low complexity, requiring no privileges or user interaction-yet the EPSS score of 0.13% (33rd percentile) suggests low probability of widespread exploitation in the wild. This discrepancy likely reflects the specialized nature of industrial charging infrastructure rather than technical barriers to exploitation. SSVC framework confirms the vulnerability is fully automatable (yes) with total technical impact but notes no current exploitation, aligning with EPSS predictions. The industrial control system context (ICS-CERT advisory) elevates real-world priority despite low EPSS, as EV charging infrastructure qualifies as critical infrastructure where availability and integrity attacks carry physical safety and economic consequences beyond typical IT systems. Authentication bypass in industrial protocols typically sees targeted exploitation by sophisticated actors rather than mass scanning, explaining the EPSS-CVSS gap. Organizations operating CTEK Chargeportal should treat this as high priority given the complete absence of authentication, ease of exploitation, and potential for operational disruption across charging networks. The total technical impact assessment is accurate-attackers gain equivalent access to legitimate charging stations without any authentication hurdle.

An attacker scans internet-facing IP ranges to identify CTEK Chargeportal deployments exposing OCPP WebSocket endpoints (typically TCP ports 80/443 with specific URL paths). Using publicly available OCPP protocol specifications and observed charging station identifier patterns (often sequential or location-based), the attacker establishes WebSocket connections impersonating multiple legitimate chargers. They inject fraudulent OCPP messages to report false charging session data (inflating energy consumption for billing fraud), issue remote start/stop commands to disrupt fleet charging operations during peak demand periods, or manipulate firmware update messages to prevent legitimate security patches. No exploit code development is required beyond basic WebSocket client libraries and OCPP protocol knowledge, making this readily automatable as SSVC assessment indicates.