CVE-2026-29796
published 2026-03-20CVE-2026-29796: WebSocket endpoints lack proper authentication mechanisms, enabling attackers to perform unauthorized station impersonation and manipulate data sent to the…
PriorityP270critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
EPSS
0.47%
37.0th percentile
WebSocket endpoints lack proper authentication mechanisms, enabling attackers to perform unauthorized station impersonation and manipulate data sent to the backend. An unauthenticated attacker can connect to the OCPP WebSocket endpoint using a known or discovered charging station identifier, then issue or receive OCPP commands as a legitimate charger. Given that no authentication is required, this can lead to privilege escalation, unauthorized control of charging infrastructure, and corruption of charging network data reported to the backend.
Affected
1 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| igl-technologies | eparking.fi | — | — |
Detection & IOCsextracted from sources · hover to see the quote
- →Monitor for unauthenticated WebSocket connections to OCPP endpoints — an attacker connects using only a known or discovered charging station identifier with no credentials ↗
- →Alert on multiple simultaneous WebSocket sessions sharing the same charging station session identifier, which indicates session hijacking or shadowing activity ↗
- →Detect high-volume or rapid repeated authentication requests to the OCPP WebSocket API, indicative of brute-force or DoS attempts against the unauthenticated endpoint ↗
- →Flag any OCPP WebSocket connections originating from non-whitelisted devices or IP addresses, as the vulnerability allows any client to impersonate a charging station ↗
- ·Devices using the encrypted deployment of eParking's OCPP servers or IGL-Technologies proprietary eTolppa protocol are explicitly stated as NOT impacted by these vulnerabilities — scope detection rules accordingly ↗
- ·All versions of IGL-Technologies eParking.fi are affected (vers:all/*); there is no safe unpatched version to exclude from scope ↗
- ·Charging station authentication identifiers are publicly accessible via web-based mapping platforms, meaning attackers can trivially enumerate valid station IDs to use in exploitation — treat all station IDs as potentially compromised ↗
CVSS provenance
nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv4.09.3CRITICALCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
CISA ICS
IGL-Technologies eParking.fi
cisa_ics·2026-03-19·CVSS 9.4
[CRITICAL] IGL-Technologies eParking.fi
ICS Advisory
##
IGL-Technologies eParking.fi
Release DateMarch 19, 2026
Alert CodeICSA-26-078-07
Related topics:
Industrial Control System Vulnerabilities, Industrial Control Systems
View CSAF
## Summary
Successful exploitation of these vulnerabilities could enable attackers to gain unauthorized administrative control over vulnerable charging stations or disrupt charging services through denial-of-service attacks.
The following versions of IGL-Technologies eParking.fi are affected:
- eParking.fi vers:all/*
CVSS
Vendor
Equipment
Vulnerabilities
| v3 9.4
| IGL-Technologies
| IGL-Technologies eParking.fi
| Missing Authentication for Critical Function, Improper Restriction of Excessive Authentication Attempts, Insufficient Session Expiration, Insufficiently P
VulDB
IGL-Technologies eParking.fi WebSocket Endpoint missing authentication (icsa-26-078-08)
vuldb·2026-05-17·CVSS 9.3
CVE-2026-29796 [CRITICAL] IGL-Technologies eParking.fi WebSocket Endpoint missing authentication (icsa-26-078-08)
A vulnerability classified as critical has been found in IGL-Technologies eParking.fi. This vulnerability affects unknown code of the component WebSocket Endpoint. This manipulation causes missing authentication.
This vulnerability is tracked as CVE-2026-29796. The attack is possible to be carried out remotely. No exploit exists.
GHSA
GHSA-3pgw-qmv2-hv8m: WebSocket endpoints lack proper authentication mechanisms, enabling attackers to perform unauthorized station impersonation and manipulate data sent t
ghsa_unreviewed·2026-03-21
CVE-2026-29796 [CRITICAL] CWE-306 GHSA-3pgw-qmv2-hv8m: WebSocket endpoints lack proper authentication mechanisms, enabling attackers to perform unauthorized station impersonation and manipulate data sent t
WebSocket endpoints lack proper authentication mechanisms, enabling attackers to perform unauthorized station impersonation and manipulate data sent to the backend. An unauthenticated attacker can connect to the OCPP WebSocket endpoint using a known or discovered charging station identifier, then issue or receive OCPP commands as a legitimate charger. Given that no authentication is required, this can lead to privilege escalation, unauthorized control of charging infrastructure, and corruption of charging network data reported to the backend.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2026-03-20
Published