WebSocket endpoints lack proper authentication mechanisms, enabling attackers to perform unauthorized station impersonation and manipulate data sent to the backend. An unauthenticated attacker can connect to the OCPP WebSocket endpoint using a known or discovered charging station identifier, then issue or receive OCPP commands as a legitimate charger. Given that no authentication is required, this can lead to privilege escalation, unauthorized control of charging infrastructure, and corruption of charging network data reported to the backend.
Metrics
Affected Vendors & Products
| Vendors | Products |
|---|---|
| Everon |
|
No data.
No data.
References
History
Mon, 09 Mar 2026 10:15:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| First Time appeared |
Everon
Everon api.everon.io |
|
| Vendors & Products |
Everon
Everon api.everon.io |
Fri, 06 Mar 2026 15:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | WebSocket endpoints lack proper authentication mechanisms, enabling attackers to perform unauthorized station impersonation and manipulate data sent to the backend. An unauthenticated attacker can connect to the OCPP WebSocket endpoint using a known or discovered charging station identifier, then issue or receive OCPP commands as a legitimate charger. Given that no authentication is required, this can lead to privilege escalation, unauthorized control of charging infrastructure, and corruption of charging network data reported to the backend. | |
| Title | Everon api.everon.io Missing Authentication for Critical Function | |
| Weaknesses | CWE-306 | |
| References |
| |
| Metrics |
cvssV3_1
|
MITRE
Status: PUBLISHED
Assigner: icscert
Published: 2026-03-06T15:15:19.617Z
Updated: 2026-03-06T15:15:19.617Z
Reserved: 2026-02-25T15:28:27.119Z
Link: CVE-2026-26288
Vulnrichment
No data.
NVD
Status : Awaiting Analysis
Published: 2026-03-06T16:16:10.723
Modified: 2026-03-09T13:35:34.633
Link: CVE-2026-26288
Redhat
No data.