CVE-2026-25192
published 2026-03-20CVE-2026-25192: WebSocket endpoints lack proper authentication mechanisms, enabling attackers to perform unauthorized station impersonation and manipulate data sent to the…
PriorityP270critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
EPSS
0.48%
38.0th percentile
WebSocket endpoints lack proper authentication mechanisms, enabling attackers to perform unauthorized station impersonation and manipulate data sent to the backend. An unauthenticated attacker can connect to the OCPP WebSocket endpoint using a known or discovered charging station identifier, then issue or receive OCPP commands as a legitimate charger. Given that no authentication is required, this can lead to privilege escalation, unauthorized control of charging
infrastructure, and corruption of charging network data reported to the backend.
Affected
1 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| ctek | chargeportal | — | — |
Detection & IOCsextracted from sources · hover to see the quote
- →Monitor for unauthenticated WebSocket connections to OCPP endpoints using charging station identifiers — no credentials are required to connect and issue OCPP commands ↗
- →Alert on multiple WebSocket sessions connecting with the same charging station session identifier, which may indicate session hijacking or shadowing attempts ↗
- →Detect high-rate authentication requests to the OCPP WebSocket API endpoint, which may indicate brute-force or denial-of-service activity ↗
- →Charging station authentication identifiers may be harvested from public web-based mapping platforms and used to impersonate legitimate chargers — correlate externally visible identifiers against WebSocket connection attempts ↗
- ·All versions of CTEK Chargeportal are affected; there is no patched version — vendor is sunsetting the product in April 2026 ↗
- ·No known public exploitation specifically targeting these vulnerabilities has been reported to CISA at time of advisory publication ↗
CVSS provenance
nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv4.09.3CRITICALCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
CTEK Chargeportal WebSocket Endpoint missing authentication (icsa-26-078-06)
vuldb·2026-05-07·CVSS 9.3
CVE-2026-25192 [CRITICAL] CTEK Chargeportal WebSocket Endpoint missing authentication (icsa-26-078-06)
A vulnerability marked as critical has been reported in CTEK Chargeportal. Affected by this issue is some unknown functionality of the component WebSocket Endpoint. The manipulation leads to missing authentication.
This vulnerability is referenced as CVE-2026-25192. Remote exploitation of the attack is possible. No exploit is available.
GHSA
GHSA-gm9p-728x-c9h8: WebSocket endpoints lack proper authentication mechanisms, enabling attackers to perform unauthorized station impersonation and manipulate data sent t
ghsa_unreviewed·2026-03-21
CVE-2026-25192 [CRITICAL] CWE-306 GHSA-gm9p-728x-c9h8: WebSocket endpoints lack proper authentication mechanisms, enabling attackers to perform unauthorized station impersonation and manipulate data sent t
WebSocket endpoints lack proper authentication mechanisms, enabling attackers to perform unauthorized station impersonation and manipulate data sent to the backend. An unauthenticated attacker can connect to the OCPP WebSocket endpoint using a known or discovered charging station identifier, then issue or receive OCPP commands as a legitimate charger. Given that no authentication is required, this can lead to privilege escalation, unauthorized control of charging
infrastructure, and corruption of charging network data reported to the backend.
CISA ICS
CTEK Chargeportal
cisa_ics·2026-03-19·CVSS 9.4
[CRITICAL] CTEK Chargeportal
ICS Advisory
##
CTEK Chargeportal
Release DateMarch 19, 2026
Alert CodeICSA-26-078-06
Related topics:
Industrial Control System Vulnerabilities, Industrial Control Systems
View CSAF
## Summary
Successful exploitation of these vulnerabilities could enable attackers to gain unauthorized administrative control over vulnerable charging stations or disrupt charging services through denial-of-service attacks.
The following versions of CTEK Chargeportal are affected:
- Chargeportal vers:all/*
CVSS
Vendor
Equipment
Vulnerabilities
| v3 9.4
| CTEK
| CTEK Chargeportal
| Missing Authentication for Critical Function, Improper Restriction of Excessive Authentication Attempts, Insufficient Session Expiration, Insufficiently Protected Credentials
## Background
- Criti
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2026-03-20
Published