CVE-2026-27028
Published: 27 February 2026
Description
WebSocket endpoints lack proper authentication mechanisms, enabling attackers to perform unauthorized station impersonation and manipulate data sent to the backend. An unauthenticated attacker can connect to the OCPP WebSocket endpoint using a known or discovered charging station identifier, then issue…
more
or receive OCPP commands as a legitimate charger. Given that no authentication is required, this can lead to privilege escalation, unauthorized control of charging infrastructure, and corruption of charging network data reported to the backend.
Mitigating Controls (NIST 800-53 r5)AI
Requires unique identification and authentication of charging station devices before establishing WebSocket connections, directly preventing unauthorized station impersonation.
Mandates identification and documentation of any permitted actions without authentication on OCPP WebSocket endpoints, ensuring critical functions like command issuance require authentication.
Enforces approved access authorizations for OCPP WebSocket endpoints, blocking unauthenticated attackers from manipulating data or issuing commands as legitimate chargers.
Security SummaryAI
CVE-2026-27028 is a critical vulnerability in OCPP WebSocket endpoints that lack proper authentication mechanisms, allowing attackers to perform unauthorized station impersonation and manipulate data sent to the backend. Published on 2026-02-27, it affects charging infrastructure components implementing the Open Charge Point Protocol (OCPP), where no authentication is required for connections. Mapped to CWE-306 (Missing Authentication for Critical Function), the issue has a CVSS v3.1 base score of 9.4 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L), indicating high confidentiality, integrity, and limited availability impacts.
An unauthenticated attacker can exploit this by connecting to the OCPP WebSocket endpoint using a known or discovered charging station identifier, then issuing or receiving OCPP commands as a legitimate charger. This enables privilege escalation, unauthorized control over charging infrastructure, and corruption of charging network data reported to the backend, all over the network with low complexity and no user interaction required.
CISA has issued ICS Advisory ICSA-26-057-08 detailing the vulnerability, available alongside related files from cisagov/CSAF and Mobility46. These resources provide further guidance on the issue in operational technology contexts.
Details
- CWE(s)
Affected Products
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Unauthenticated OCPP WebSocket endpoint enables remote exploitation of a public-facing application (T1190), facilitating station impersonation for privilege escalation (T1068) and unauthorized data manipulation.