CVE Intelligence
Analysis AI-assisted

CVE-2026-25192: CTEK Charge Portal Missing Authentication on WebSocket Endpoints

CVE-2026-25192 affects CTEK Charge Portal, where WebSocket endpoints lack proper authentication, as described in the CNA record. An unauthenticated attacker could reportedly connect to the OCPP WebSocket endpoint using a known or discovered charging station identifier. The NVD base score is 9.8 (CVSS 3.1, critical), and no confirmed exploitation appears in the sources consulted.

Published Oct 24, 2026 · Updated Oct 24, 2026 · Ler em português

Overview

CVE-2026-25192 is a missing authentication issue (CWE-306) in the WebSocket endpoints of the CTEK Charge Portal. According to the CNA description, the endpoints do not enforce proper authentication, which can allow an unauthenticated party to impersonate a charging station. The advisory referenced by CISA is ICSA-26-078-06.

Impact

  • The source describes possible privilege escalation and unauthorized control of charging infrastructure.
  • The source describes possible corruption of charging network data reported to the backend.
  • The NVD assigns CVSS 3.1 base score 9.8 with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, which reflects network reachability, low complexity and no privileges or user interaction required.
  • CISA SSVC data in the record lists exploitation as none, automatable as yes and technical impact as total.

Affected products and versions

  • Product: Ctek Charge Portal.
  • The record lists the affected versions as "versions not specified by the source" and "All versions", but no specific version strings are provided.
  • The record contains no fixed versions.

Exploitation status

The CISA KEV catalog does not list this CVE in the record. No confirmed exploitation appears in the sources consulted. The EPSS probability in the record is 0.00492 (percentile 0.41353), which is a statistical estimate and not evidence of exploitation.

Remediation and mitigation

  • Check the vendor support page and the CISA advisory for current guidance from CTEK.
  • Restrict network access to the Charge Portal WebSocket endpoints to trusted segments, and place charging backend interfaces behind segmentation controls.
  • Monitor the vendor channels for an authentication update, since the record contains no fix information.
  • Review the inventory of charging stations and backend connections to identify where the portal is deployed.

Detection guidance

  • Review logs of the charging backend for connections from unexpected sources or for station identifiers that do not match the expected inventory.
  • Alert on charging station sessions that appear without an expected provisioning or authentication event.
  • Watch for unexpected changes in charging session or energy data reported to the backend.

Limitations of the available information

The record does not specify exact affected versions, fixed versions, or the mechanism of the missing authentication beyond the CNA description. The CVSS 3.1 base score of 9.8 comes from NVD, while the ICS-CERT and CNA entries list scores of 9.3 (CVSS 4.0) and 9.4 (CVSS 3.1). The publication date of the EPSS data is listed as 2026-10-23, which should be verified against the source.

Frequently asked questions

What is the core problem in CVE-2026-25192?

The WebSocket endpoints of the CTEK Charge Portal lack proper authentication, so an unauthenticated party may be able to connect as a charging station. The weakness is classified as CWE-306.

Is there a confirmed fix for this CVE?

The record contains no fixed versions. Check the CTEK support page and the CISA advisory ICSA-26-078-06 for current guidance.

Is this CVE known to be exploited?

The CVE is not listed in the CISA KEV catalog in the record, and no confirmed exploitation appears in the sources consulted.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.