Cyber Posture

CVE-2026-25192

Critical

Published: 20 March 2026

Published
20 March 2026
Modified
06 May 2026
KEV Added
—
Patch
—
CVSS Score 9.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L
EPSS Score 0.0014 33.5th percentile
Risk Priority 19 60% EPSS · 20% KEV · 20% CVSS

Description

WebSocket endpoints lack proper authentication mechanisms, enabling attackers to perform unauthorized station impersonation and manipulate data sent to the backend. An unauthenticated attacker can connect to the OCPP WebSocket endpoint using a known or discovered charging station identifier, then issue…

more

or receive OCPP commands as a legitimate charger. Given that no authentication is required, this can lead to privilege escalation, unauthorized control of charging infrastructure, and corruption of charging network data reported to the backend.

Mitigating Controls (NIST 800-53 r5)AI

AC-14 Permitted Actions Without Identification or Authentication good match
prevent

Directly requires limiting permitted actions without identification or authentication, preventing unauthorized station impersonation and data manipulation on unauthenticated WebSocket endpoints.

IA-3 Device Identification and Authentication good match
prevent

Mandates device identification and authentication before establishing connections, mitigating impersonation of charging stations via OCPP WebSocket endpoints.

SC-23 Session Authenticity good match
prevent

Ensures authenticity of communications sessions like WebSockets by requiring unique identification and authentication, blocking unauthorized command issuance and data corruption.

Security SummaryAI

CVE-2026-25192 is a high-severity vulnerability (CVSS 9.4, CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L) stemming from WebSocket endpoints lacking proper authentication mechanisms, as documented under CWE-306 (Missing Authentication for Critical Function). It affects OCPP (Open Charge Point Protocol) WebSocket endpoints in charging station software, specifically those from CTEK, enabling attackers to perform unauthorized station impersonation and manipulate data sent to backend systems.

An unauthenticated attacker with network access can exploit this by connecting to the OCPP WebSocket endpoint using a known or discovered charging station identifier. This allows them to issue or receive OCPP commands as a legitimate charger, resulting in privilege escalation, unauthorized control over charging infrastructure, and corruption of charging network data reported to the backend.

CISA advisory ICSA-26-078-06 and related resources, including CTEK's support page, provide details on mitigation strategies; practitioners should consult these references for patching instructions and remediation guidance.

Details

CWE(s)
CWE-306

Affected Products

ctek
charge portal
all versions

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
T1068 Exploitation for Privilege Escalation Privilege Escalation
Adversaries may exploit software vulnerabilities in an attempt to elevate privileges.
attack.mitre.org →
Why these techniques?

Unauthenticated WebSocket endpoints enable exploitation of public-facing application (T1190) for initial access via missing authentication, facilitating privilege escalation (T1068) through unauthorized station impersonation and control.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

References