CVE-2026-24731
published 2026-02-27CVE-2026-24731: WebSocket endpoints lack proper authentication mechanisms, enabling attackers to perform unauthorized station impersonation and manipulate data sent to the…
PriorityP271critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
EPSS
0.56%
42.2th percentile
WebSocket endpoints lack proper authentication mechanisms, enabling
attackers to perform unauthorized station impersonation and manipulate
data sent to the backend. An unauthenticated attacker can connect to the
OCPP WebSocket endpoint using a known or discovered charging station
identifier, then issue or receive OCPP commands as a legitimate charger.
Given that no authentication is required, this can lead to privilege
escalation, unauthorized control of charging infrastructure, and
corruption of charging network data reported to the backend.
Affected
1 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| ev2go | ev2go.io | — | — |
Detection & IOCsextracted from sources · hover to see the quote
- →Monitor for unauthenticated WebSocket connections to OCPP endpoints using charging station identifiers — no credentials are required to connect and issue OCPP commands ↗
- →Alert on multiple simultaneous WebSocket sessions sharing the same charging station session identifier, which indicates session hijacking or shadowing activity ↗
- →Detect high-rate authentication attempts against the OCPP WebSocket API endpoint, which has no rate limiting and is susceptible to brute-force and DoS attacks ↗
- ·All versions of EV2GO ev2go.io are affected; there is no patched version available as the vendor did not respond to CISA coordination — no version-based filtering is possible ↗
- ·Charging station authentication identifiers are publicly accessible via web-based mapping platforms, meaning attackers can trivially enumerate valid station IDs to use in exploitation ↗
- ·No known public exploitation has been reported to CISA at time of advisory publication ↗
CVSS provenance
nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv4.09.3CRITICALCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
CISA ICS
EV2GO ev2go.io
cisa_ics·2026-02-26·CVSS 7.3
[HIGH] EV2GO ev2go.io
ICS Advisory
##
EV2GO ev2go.io
Release DateFebruary 26, 2026
Alert CodeICSA-26-057-04
Related topics:
Industrial Control System Vulnerabilities, Industrial Control Systems
View CSAF
## Summary
Successful exploitation of these vulnerabilities could allow attackers to impersonate charging stations, hijack sessions, suppress or misroute legitimate traffic to cause large-scale denial of service, and manipulate data sent to the backend.
The following versions of EV2GO ev2go.io are affected:
- ev2go.io vers:all/* (CVE-2026-24731, CVE-2026-25945, CVE-2026-20895, CVE-2026-22890)
CVSS
Vendor
Equipment
Vulnerabilities
| v3 9.4
| EV2GO
| EV2GO ev2go.io
| Missing Authentication for Critical Function, Improper Restriction of Excessive Authentication Attempts, Insuffic
GHSA
GHSA-627v-rfr6-xm8w: WebSocket endpoints lack proper authentication mechanisms, enabling
attackers to perform unauthorized station impersonation and manipulate
data sent t
ghsa_unreviewed·2026-02-27
CVE-2026-24731 [CRITICAL] CWE-306 GHSA-627v-rfr6-xm8w: WebSocket endpoints lack proper authentication mechanisms, enabling
attackers to perform unauthorized station impersonation and manipulate
data sent t
WebSocket endpoints lack proper authentication mechanisms, enabling
attackers to perform unauthorized station impersonation and manipulate
data sent to the backend. An unauthenticated attacker can connect to the
OCPP WebSocket endpoint using a known or discovered charging station
identifier, then issue or receive OCPP commands as a legitimate charger.
Given that no authentication is required, this can lead to privilege
escalation, unauthorized control of charging infrastructure, and
corruption of charging network data reported to the backend.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2026-02-27
Published