EUVD-2026-13852
GHSA-3pgw-qmv2-hv8m
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessConnect to OCPP WebSocket endpoint
-
DeliveryImpersonate charging station with known identifier
-
ExploitIssue unauthorized OCPP commands
-
ExecutionManipulate charging infrastructure data
-
ImpactExfiltrate sensitive information or corrupt backend state
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A07:2025 - Authentication Failures
ASVS 5.0
V6 - Authentication Authentication required for critical functions
MITRE ATT&CK
1 technique across 1 tactic: Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | No special conditions — remote unauthenticated exploitation against default OCPP WebSocket endpoints lacking authentication. Attacker needs only a known or discovered charging station identifier to connect and impersonate legitimate chargers, issue/receive OCPP commands, and manipulate backend data. |
| Impact | This vulnerability presents critical real-world risk with multiple concerning factors. The CVSS 3.1 score of 9.4 reflects network accessibility (AV:N), low attack complexity (AC:L), no privileges required (PR:N), and no user interaction needed (UI:N), with high impacts to confidentiality and integrity and low availability impact. The vulnerability targets operational technology infrastructure (ICS-CERT advisory), specifically EV charging networks that are increasingly critical to transportation infrastructure. The attack is highly automatable as it requires only network access and knowledge of station identifiers, which may be enumerable or publicly documented. While no EPSS score or KEV listing is provided in the available data, the authentication bypass in industrial control systems represents a high-priority remediation target due to potential for widespread automated exploitation, unauthorized control of physical infrastructure, financial fraud through charging manipulation, and safety implications. The SSVC framework would likely classify this as requiring immediate action given its automatable nature, critical infrastructure context, and potential for efficient exploitation at scale. |
| Exploit ScenarioDerived | An attacker scans the internet for exposed OCPP WebSocket endpoints on port 443 or 8080 and identifies an eparking.fi installation. Using publicly available charging station identifiers obtained from mobile apps or by enumerating sequential IDs, the attacker establishes a WebSocket connection claiming to be a legitimate charging station. The attacker then issues OCPP commands to report fraudulent charging sessions for financial gain, reconfigure charging station parameters to deny service to legitimate users, or exfiltrate sensitive charging transaction data including user payment information and vehicle identifiers. Given the network-accessible attack vector and lack of authentication, this attack can be automated and executed remotely without physical access to charging infrastructure. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 20, 2026
Unauthenticated access to OCPP WebSocket endpoints allows remote attackers to impersonate legitimate charging stations and execute arbitrary commands against electric vehicle charging infrastructure without credentials. An attacker can connect using a known station identifier to manipulate charging operations, alter backend data, and escalate privileges across the charging network. No patch is currently available for this critical vulnerability affecting EV charging systems.
Earlier versions of this analysis (1)
An authentication bypass vulnerability exists in IGL Technologies eparking.fi WebSocket endpoints that allows unauthenticated attackers to impersonate legitimate EV charging stations by connecting to OCPP WebSocket endpoints with known station identifiers. This critical flaw enables unauthorized control of charging infrastructure, privilege escalation, and data manipulation in the charging network backend. The vulnerability is reported by ICS-CERT targeting operational technology infrastructure with a CVSS score of 9.4, indicating severe real-world risk to critical infrastructure.
RemediationAI
Immediately implement WebSocket authentication mechanisms for all OCPP endpoints, requiring mutual TLS authentication or token-based authentication before processing any charging station commands. Consult the CISA ICS advisory at https://www.cisa.gov/news-events/ics-advisories/icsa-26-078-08 for vendor-provided patches or security updates addressing CVE-2026-29796. As interim mitigations until patches can be deployed, restrict network access to OCPP WebSocket endpoints using firewall rules that only permit connections from known charging station IP addresses, implement network segmentation to isolate charging infrastructure from untrusted networks, and deploy intrusion detection systems to monitor for suspicious connection attempts or command patterns. Deploy a reverse proxy or API gateway in front of WebSocket endpoints to enforce authentication policies and rate limiting. Review charging station identifier allocation processes to prevent predictable or enumerable station IDs that facilitate impersonation attacks.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
This vulnerability affects the Open Charge Point Protocol (OCPP) WebSocket implementation in IGL Technologies eparking.fi electric vehicle charging management platform (CPE: cpe:2.3:a:igl-technologies:eparking.fi). OCPP is a widely-used protocol for communication between EV charging stations and central management systems. The root cause is CWE-306 (Missing Authentication for Critical Function), where the WebSocket endpoint accepts connections and processes OCPP commands without validating the identity of the connecting client. This allows any network-accessible attacker to establish a WebSocket connection, claim to be a legitimate charging station using a valid or guessed station identifier, and execute charging commands or receive configuration updates intended for authorized infrastructure components.
Know when Eparking Fi gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
2DescriptionCVE.org
WebSocket endpoints lack proper authentication mechanisms, enabling attackers to perform unauthorized station impersonation and manipulate data sent to the backend. An unauthenticated attacker can connect to the OCPP WebSocket endpoint using a known or discovered charging station identifier, then issue or receive OCPP commands as a legitimate charger. Given that no authentication is required, this can lead to privilege escalation, unauthorized control of charging infrastructure, and corruption of charging network data reported to the backend.
Executive ViewAI
A critical authentication bypass vulnerability in eparking.fi WebSocket endpoints allows attackers to impersonate EV charging stations and gain unauthorized control of charging infrastructure without credentials. Organizations operating or dependent on this charging network face immediate risk of service disruption, data theft, and potential physical safety hazards to users and grid stability.
Implement network-level access controls restricting WebSocket endpoint connections to whitelisted station identifiers and IP ranges; deploy WAF rules to validate and enforce strict OCPP protocol compliance and session validation; segment charging infrastructure from critical backend systems using firewalls and VLANs; disable WebSocket endpoints if not actively required; increase real-time monitoring and alerting for anomalous charging station behavior and connection patterns; require VPN or TLS mutual authentication for all station connections; implement rate limiting and connection throttling on WebSocket endpoints.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.
More in Eparking Fi
View allUnlimited authentication attempts against the eParking.fi WebSocket API enable network-based denial-of-service attacks t
A session management vulnerability exists in the WebSocket backend of IGL Technologies' eparking.fi platform that allows
A web-based mapping platform exposes charging station authentication identifiers publicly, allowing unauthenticated netw
Exploit-DB