cbcvebase.
CVE-2026-26051
published 2026-03-06

CVE-2026-26051: WebSocket endpoints lack proper authentication mechanisms, enabling attackers to perform unauthorized station impersonation and manipulate data sent to the…

PriorityP272critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
EPSS
0.87%
54.3th percentile
WebSocket endpoints lack proper authentication mechanisms, enabling attackers to perform unauthorized station impersonation and manipulate data sent to the backend. An unauthenticated attacker can connect to the OCPP WebSocket endpoint using a known or discovered charging station identifier, then issue or receive OCPP commands as a legitimate charger. Given that no authentication is required, this can lead to privilege escalation, unauthorized control of charging infrastructure, and corruption of charging network data reported to the backend.

Affected

1 ranges
VendorProductVersion rangeFixed in
mobilitie-mobi.hu——

Detection & IOCsextracted from sources · hover to see the quote

  • →Detect unauthenticated WebSocket connections to OCPP endpoints — any connection that does not present valid credentials but proceeds to issue or receive OCPP commands should be flagged as potential station impersonation. ↗
  • →Alert on OCPP WebSocket traffic originating from unexpected or external IP ranges targeting the Mobiliti e-mobi.hu backend — the vulnerability is network-accessible with no privileges required (CVSS AV:N/AC:L/PR:N/UI:N). ↗
  • ·All versions of Mobiliti e-mobi.hu are affected; there is no patched version available and the vendor has not responded to CISA coordination requests. Defensive measures (network isolation, firewall, VPN) are the only available mitigations. ↗
  • ·Charging station authentication identifiers (used as WebSocket session identifiers) are publicly discoverable via web-based mapping platforms, lowering the bar for exploitation significantly — treat all station IDs as potentially compromised. ↗

CVSS provenance

nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv4.09.3CRITICALCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.