cbcvebase.
CVE-2026-29796
published 2026-03-20

CVE-2026-29796: WebSocket endpoints lack proper authentication mechanisms, enabling attackers to perform unauthorized station impersonation and manipulate data sent to the…

PriorityP270critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
EPSS
0.47%
37.0th percentile
WebSocket endpoints lack proper authentication mechanisms, enabling attackers to perform unauthorized station impersonation and manipulate data sent to the backend. An unauthenticated attacker can connect to the OCPP WebSocket endpoint using a known or discovered charging station identifier, then issue or receive OCPP commands as a legitimate charger. Given that no authentication is required, this can lead to privilege escalation, unauthorized control of charging infrastructure, and corruption of charging network data reported to the backend.

Affected

1 ranges
VendorProductVersion rangeFixed in
igl-technologieseparking.fi

Detection & IOCsextracted from sources · hover to see the quote

  • Monitor for unauthenticated WebSocket connections to OCPP endpoints — an attacker connects using only a known or discovered charging station identifier with no credentials
  • Alert on multiple simultaneous WebSocket sessions sharing the same charging station session identifier, which indicates session hijacking or shadowing activity
  • Detect high-volume or rapid repeated authentication requests to the OCPP WebSocket API, indicative of brute-force or DoS attempts against the unauthenticated endpoint
  • Flag any OCPP WebSocket connections originating from non-whitelisted devices or IP addresses, as the vulnerability allows any client to impersonate a charging station
  • ·Devices using the encrypted deployment of eParking's OCPP servers or IGL-Technologies proprietary eTolppa protocol are explicitly stated as NOT impacted by these vulnerabilities — scope detection rules accordingly
  • ·All versions of IGL-Technologies eParking.fi are affected (vers:all/*); there is no safe unpatched version to exclude from scope
  • ·Charging station authentication identifiers are publicly accessible via web-based mapping platforms, meaning attackers can trivially enumerate valid station IDs to use in exploitation — treat all station IDs as potentially compromised

CVSS provenance

nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv4.09.3CRITICALCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.