CVE-2026-22552: ePower ePower.ie Missing Authentication for Critical Function
ePower ePower.ie exposes WebSocket endpoints without proper authentication, so an unauthenticated party may impersonate a charging station and alter data sent to the backend. NVD lists a CVSS base score of 9.8 and maps the issue to CWE-306. No confirmed exploitation appears in the sources consulted, and the record does not identify a fixed version.
Overview
According to the CISA ICS advisory ICSA-26-062-07, the WebSocket endpoints of ePower ePower.ie lack proper authentication. The weakness is classified as CWE-306, Missing Authentication for Critical Function.
Impact
The record describes the following possible consequences:
- Unauthorized station impersonation, where a party connects to the OCPP WebSocket endpoint with a known or discovered charging station identifier.
- Manipulation of data sent to the backend, including corruption of charging network data.
- Privilege escalation and unauthorized control of charging infrastructure.
The NVD CVSS vector rates confidentiality, integrity and availability impact as high, with a base score of 9.8 and no privileges or user interaction required (NVD entry).
Affected products and versions
The affected product is listed as Epower Epower.ie. The source does not specify the affected versions, and the record contains no version numbers. Vendor support information is available at the ePower support page. Consult the vendor and the CSAF document for the authoritative scope.
Exploitation status
The CISA Known Exploited Vulnerabilities catalog does not list this CVE in the record. No confirmed exploitation appears in the sources consulted. The SSVC data in the record marks exploitation as none and automatable as yes, and the EPSS probability is 0.00944 with a percentile of 0.6071. These values are estimates and do not confirm exploitation.
Remediation and mitigation
The record does not include a fix or patch. The absence of fixed-version data does not mean no fix exists; check the vendor support page and the CSAF advisory for updates.
- Contact ePower for guidance and for any update that adds authentication to the affected endpoints.
- Restrict network access to the charging backend WebSocket endpoints to trusted sources and networks.
- Segment the charging infrastructure network from general corporate and internet-facing networks.
- Review the vendor and CISA guidance on compensating controls while no fix is confirmed.
Detection guidance
At a high level, operators can look for signs of impersonation in backend logs:
- Charger identifiers connecting from unexpected addresses or networks.
- Duplicate or overlapping sessions for the same station identifier.
- Unexpected changes or gaps in reported meter, session or status data.
Limitations of the available information
The record provides no affected or fixed version numbers, no vendor-confirmed patch, and no technical detail on how the authentication gap is implemented. The ePower support page and the CSAF document were referenced but their content was not part of the record, so their specific guidance is unknown here.
Frequently asked questions
What is the core weakness in CVE-2026-22552?
The WebSocket endpoints of ePower ePower.ie lack proper authentication, which is classified as CWE-306 Missing Authentication for Critical Function.
Is this vulnerability known to be actively exploited?
The record does not list it in the CISA KEV catalog, and no confirmed exploitation appears in the sources consulted.
Is a fixed version available?
The record does not name a fixed version or patch. This does not mean no fix exists, so check the vendor support page and the CISA advisory.
This analysis was drafted with AI assistance from verified source data and automatically checked against it.