CVE-2026-27028: Mobility46.se WebSocket Missing Authentication for Critical Function

Overview

The record describes WebSocket endpoints in Mobility46.se that lack proper authentication. The described OCPP WebSocket endpoint can be reached by an unauthenticated party who knows or discovers a charging station identifier, and the record states this allows commands to be issued or received as a legitimate charger. The weakness is classified as CWE-306, Missing Authentication for Critical Function. Sources: NVD and CISA advisory ICSA-26-057-08.

Impact

• The record states the flaw can lead to privilege escalation.
• The record states it can allow unauthorized control of charging infrastructure.
• The record states it can corrupt charging network data reported to the backend.
• Our inference: because the identifier may be guessable or discoverable, the practical barrier to impersonation may be low, although the sources do not quantify this.

Affected products and versions

• Product: Mobility46 Mobility46.se.
• The sources state that affected versions are not specified and also list the version as all versions. No specific version range is given.
• No affected version list is available in the structured data, so the exact scope must be confirmed with the vendor.

Exploitation status

• The CISA Known Exploited Vulnerabilities catalog does not list this CVE in the record.
• No confirmed exploitation in the wild appears in the sources consulted.
• The SSVC data in the record indicates exploitation as none and automatable as yes; this is an assessment, not evidence of attacks.

Remediation and mitigation

• The record lists no fixed version. A missing fixed version does not mean no fix exists; availability of a fix is unknown.
• Contact the vendor through the Mobility46 contact page to request guidance, patches or compensating controls.
• Restrict access to charging backend WebSocket endpoints to trusted networks and charging station segments, for example with network segmentation and allowlisting.
• Require strong device authentication at the backend for every charging station connection, and review whether identifiers can be used alone to establish sessions.
• Limit the impact of any data corruption by validating station-reported data and reconciling it against independent records.

Detection guidance

• Monitor for connections to the OCPP WebSocket endpoint from unknown or unexpected sources.
• Alert on a single charging station identifier appearing from multiple or unusual network origins.
• Review logs for commands or status updates from stations that do not match expected operational behavior.
• Compare backend charging records with physical station activity to detect unexplained data.

Limitations of the available information

• The record gives no fixed version, no vendor patch details and no list of specific affected versions.
• Only the NVD and CISA references are available; no vendor advisory text was provided.
• The CVSS scores differ among providers (9.8 from NVD, 9.3 and 9.4 from the ICS-CERT entries); the NVD score is shown as the primary value.
• The exploitation probability in the record is low, but this does not establish whether attacks occur.

Frequently asked questions

What is the core weakness in CVE-2026-27028?

The WebSocket endpoints, including the OCPP endpoint, lack proper authentication, which is classified as CWE-306 Missing Authentication for Critical Function.

Is this CVE known to be actively exploited?

The CISA KEV listing in the record is false, and no confirmed exploitation in the wild appears in the sources consulted.

Is a fixed version available?

The record lists no fixed version, so availability of a fix is unknown. Contact the vendor through its contact page for guidance.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.