CVE-2026-27767
published 2026-02-27CVE-2026-27767: WebSocket endpoints lack proper authentication mechanisms, enabling attackers to perform unauthorized station impersonation and manipulate data sent to the…
PriorityP270critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
EPSS
0.51%
39.4th percentile
WebSocket endpoints lack proper authentication mechanisms, enabling
attackers to perform unauthorized station impersonation and manipulate
data sent to the backend. An unauthenticated attacker can connect to the
OCPP WebSocket endpoint using a known or discovered charging station
identifier, then issue or receive OCPP commands as a legitimate charger.
Given that no authentication is required, this can lead to privilege
escalation, unauthorized control of charging infrastructure, and
corruption of charging network data reported to the backend.
Affected
1 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| switch_ev | swtchenergy.com | — | — |
Detection & IOCsextracted from sources · hover to see the quote
- →Monitor for unauthenticated WebSocket connections to OCPP endpoints using charging station identifiers — no credentials or tokens required by the vulnerable backend ↗
- →Alert on multiple simultaneous WebSocket sessions sharing the same charging station session identifier, which indicates session hijacking or shadowing activity ↗
- →Detect high-rate WebSocket authentication requests to the OCPP endpoint from a single source, indicative of brute-force or DoS attempts (CVE-2026-25113) ↗
- ·All versions of SWITCH EV swtchenergy.com are affected; no patched version exists as the vendor did not respond to CISA coordination — treat all deployments as vulnerable ↗
- ·Charging station authentication identifiers are publicly discoverable via web-based mapping platforms, meaning attackers can enumerate valid station IDs without any prior access ↗
CVSS provenance
nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv4.09.3CRITICALCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
CISA ICS
SWITCH EV swtchenergy.com
cisa_ics·2026-02-26·CVSS 7.5
[HIGH] SWITCH EV swtchenergy.com
ICS Advisory
##
SWITCH EV swtchenergy.com
Release DateFebruary 26, 2026
Alert CodeICSA-26-057-06
Related topics:
Industrial Control System Vulnerabilities, Industrial Control Systems
View CSAF
## Summary
Successful exploitation of these vulnerabilities could allow attackers to impersonate charging stations, hijack sessions, suppress or misroute legitimate traffic to cause large-scale denial of service, and manipulate data sent to the backend.
The following versions of SWITCH EV swtchenergy.com are affected:
- swtchenergy.com vers:all/* (CVE-2026-27767, CVE-2026-25113, CVE-2026-25778, CVE-2026-27773)
CVSS
Vendor
Equipment
Vulnerabilities
| v3 9.4
| SWITCH EV
| SWITCH EV swtchenergy.com
| Missing Authentication for Critical Function, Improper Restriction of
GHSA
GHSA-rvf2-2r2v-x27p: WebSocket endpoints lack proper authentication mechanisms, enabling
attackers to perform unauthorized station impersonation and manipulate
data sent t
ghsa_unreviewed·2026-02-27
CVE-2026-27767 [CRITICAL] CWE-306 GHSA-rvf2-2r2v-x27p: WebSocket endpoints lack proper authentication mechanisms, enabling
attackers to perform unauthorized station impersonation and manipulate
data sent t
WebSocket endpoints lack proper authentication mechanisms, enabling
attackers to perform unauthorized station impersonation and manipulate
data sent to the backend. An unauthenticated attacker can connect to the
OCPP WebSocket endpoint using a known or discovered charging station
identifier, then issue or receive OCPP commands as a legitimate charger.
Given that no authentication is required, this can lead to privilege
escalation, unauthorized control of charging infrastructure, and
corruption of charging network data reported to the backend.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2026-02-27
Published