CVE-2026-20781: WebSocket endpoints lack proper authentication mechanisms, enabling attackers to perform unauthorized station impersonation and manipulate data sent to the…

PriorityP271critical9.8CVSS 3.1

AVNACLPRNUINSUCHIHAH

EPSS

0.52%

40.1th percentile

WebSocket endpoints lack proper authentication mechanisms, enabling attackers to perform unauthorized station impersonation and manipulate data sent to the backend. An unauthenticated attacker can connect to the OCPP WebSocket endpoint using a known or discovered charging station identifier, then issue or receive OCPP commands as a legitimate charger. Given that no authentication is required, this can lead to privilege escalation, unauthorized control of charging infrastructure, and corruption of charging network data reported to the backend.

Affected

1 ranges

Vendor	Product	Version range	Fixed in
cloudcharge	cloudcharge.se	—	—

Detection & IOCsextracted from sources · hover to see the quote

→Monitor for unauthenticated WebSocket connections to OCPP endpoints — any connection that issues or receives OCPP commands without completing an authentication handshake should be flagged as suspicious station impersonation activity. ↗
→Alert on high-rate authentication request bursts to the CloudCharge WebSocket API from a single source — absence of rate limiting makes brute-force and DoS via request flooding viable attack vectors. ↗

·All versions of CloudCharge cloudcharge.se are affected with no vendor patch available — CloudCharge did not respond to CISA coordination requests, so no fixed version exists to target for upgrade detection. ↗
·Charging station authentication identifiers (used as WebSocket session keys) are publicly accessible via web-based mapping platforms, meaning an attacker requires no prior access to enumerate valid identifiers for exploitation. ↗

CVSS provenance

nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

nvdv4.09.3CRITICALCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.