CVE-2026-27028: WebSocket endpoints lack proper authentication mechanisms, enabling attackers to perform unauthorized station impersonation and manipulate data sent to the…

PriorityP271critical9.8CVSS 3.1

AVNACLPRNUINSUCHIHAH

EPSS

0.52%

40.1th percentile

WebSocket endpoints lack proper authentication mechanisms, enabling attackers to perform unauthorized station impersonation and manipulate data sent to the backend. An unauthenticated attacker can connect to the OCPP WebSocket endpoint using a known or discovered charging station identifier, then issue or receive OCPP commands as a legitimate charger. Given that no authentication is required, this can lead to privilege escalation, unauthorized control of charging infrastructure, and corruption of charging network data reported to the backend.

Affected

1 ranges

Vendor	Product	Version range	Fixed in
mobility46	mobility46.se	—	—

Detection & IOCsextracted from sources · hover to see the quote

→Detect unauthenticated WebSocket connections to OCPP endpoints — any connection that does not present valid credentials but uses a charging station identifier should be flagged as potential station impersonation. ↗
→Monitor for multiple WebSocket sessions sharing the same charging station session identifier — session displacement (most recent connection taking over) is a key behavioral indicator of session hijacking or shadowing. ↗
→Alert on high-rate authentication attempts against the OCPP WebSocket API from a single source — absence of rate limiting makes brute-force and DoS patterns detectable by volume alone. ↗
→Flag OCPP WebSocket connections originating from internet-facing or non-ICS network segments — the vulnerability is network-accessible with no privileges required (CVSS AV:N/AC:L/PR:N/UI:N). ↗

·All versions of Mobility46 mobility46.se are affected — there is no patched version available as the vendor did not respond to CISA coordination requests. Treat all deployments as vulnerable. ↗
·Charging station authentication identifiers are publicly exposed via web-based mapping platforms, meaning attackers can trivially enumerate valid station IDs to use in exploitation — detection must not rely on identifier secrecy. ↗
·No known public exploitation has been reported to CISA at time of advisory publication — detections are currently precautionary. ↗

CVSS provenance

nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

nvdv4.09.3CRITICALCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.