CVE-2026-27772

published 2026-02-27

CVE-2026-27772: WebSocket endpoints lack proper authentication mechanisms, enabling attackers to perform unauthorized station impersonation and manipulate data sent to the…

Priority P2 71 critical 9.8 CVSS 3.1

AV N AC L PR N UI N S U C H I H A H

WebSocket endpoints lack proper authentication mechanisms, enabling
attackers to perform unauthorized station impersonation and manipulate
data sent to the backend. An unauthenticated attacker can connect to the
OCPP WebSocket endpoint using a known or discovered charging station
identifier, then issue or receive OCPP commands as a legitimate charger.
Given that no authentication is required, this can lead to privilege
escalation, unauthorized control of charging infrastructure, and
corruption of charging network data reported to the backend.

Affected

1 ranges

Vendor	Product	Version range	Fixed in
ev_energy	ev.energy	—	—

Detection & IOCs extracted from sources · hover to see the quote

• → Monitor for unauthenticated WebSocket connections to OCPP endpoints — attacker connects using a known or discovered charging station identifier without any authentication challenge ↗
• → Alert on multiple simultaneous WebSocket sessions sharing the same charging station session identifier, which indicates session hijacking or shadowing activity ↗
• → Detect high-rate authentication attempts against the OCPP WebSocket API endpoint — absence of rate limiting enables brute-force and DoS via telemetry suppression or mis-routing ↗

• · All versions of EV Energy ev.energy are affected (vers:all/*) — no patched version exists as the vendor did not respond to CISA coordination; no version-based exclusion is possible ↗
• · Charging station authentication identifiers are publicly discoverable via web-based mapping platforms, meaning attacker reconnaissance for valid station IDs requires no special access ↗
• · No known public exploitation has been reported to CISA at time of advisory publication — detections should be treated as proactive/hunting posture ↗

CVSS provenance

nvd v3.1 9.8 CRITICAL CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

nvd v4.0 9.3 CRITICAL CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-306