CVE-2026-22552
published 2026-03-06CVE-2026-22552: WebSocket endpoints lack proper authentication mechanisms, enabling attackers to perform unauthorized station impersonation and manipulate data sent to the…
PriorityP272critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
EPSS
0.89%
54.8th percentile
WebSocket endpoints lack proper authentication mechanisms, enabling attackers to perform unauthorized station impersonation and manipulate data sent to the backend. An unauthenticated attacker can connect to the OCPP WebSocket endpoint using a known or discovered charging station identifier, then issue or receive OCPP commands as a legitimate charger. Given that no authentication is required, this can lead to privilege escalation, unauthorized control of charging infrastructure, and corruption of charging network data reported to the backend.
Affected
1 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| epower | epower.ie | — | — |
Detection & IOCsextracted from sources · hover to see the quote
- →Monitor for unauthenticated WebSocket connections to OCPP endpoints — an attacker connects to the OCPP WebSocket endpoint using a known or discovered charging station identifier without any credentials ↗
- →Alert on multiple simultaneous WebSocket sessions sharing the same charging station session identifier, which indicates session hijacking or shadowing attempts ↗
- →Alert on high-volume or rapid repeated authentication requests to the OCPP WebSocket API, indicative of brute-force or denial-of-service attempts ↗
- →Treat charging station identifiers as sensitive credentials; monitor for exposure or enumeration of these identifiers via public web-based mapping platforms ↗
- ·All versions of ePower epower.ie are affected; there is no patched version available as the vendor did not respond to CISA coordination requests ↗
- ·No known public exploitation specifically targeting these vulnerabilities has been reported to CISA at the time of advisory publication ↗
CVSS provenance
nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv4.09.3CRITICALCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
CISA ICS
ePower epower.ie
cisa_ics·2026-03-03·CVSS 9.4
[CRITICAL] ePower epower.ie
ICS Advisory
##
ePower epower.ie
Release DateMarch 03, 2026
Alert CodeICSA-26-062-07
Related topics:
Industrial Control System Vulnerabilities, Industrial Control Systems
View CSAF
## Summary
Successful exploitation of these vulnerabilities could enable attackers to gain unauthorized administrative control over vulnerable charging stations or disrupt charging services through denial-of-service attacks.
The following versions of ePower epower.ie are affected:
- epower.ie vers:all/*
CVSS
Vendor
Equipment
Vulnerabilities
| v3 9.4
| ePower
| ePower epower.ie
| Missing Authentication for Critical Function, Improper Restriction of Excessive Authentication Attempts, Insufficient Session Expiration, Insufficiently Protected Credentials
## Background
- Critical
GHSA
GHSA-89g7-mr8w-m7x2: WebSocket endpoints lack proper authentication mechanisms, enabling attackers to perform unauthorized station impersonation and manipulate data sent t
ghsa_unreviewed·2026-03-06
CVE-2026-22552 [CRITICAL] CWE-306 GHSA-89g7-mr8w-m7x2: WebSocket endpoints lack proper authentication mechanisms, enabling attackers to perform unauthorized station impersonation and manipulate data sent t
WebSocket endpoints lack proper authentication mechanisms, enabling attackers to perform unauthorized station impersonation and manipulate data sent to the backend. An unauthenticated attacker can connect to the OCPP WebSocket endpoint using a known or discovered charging station identifier, then issue or receive OCPP commands as a legitimate charger. Given that no authentication is required, this can lead to privilege escalation, unauthorized control of charging infrastructure, and corruption of charging network data reported to the backend.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2026-03-06
Published