CVE Intelligence
Analysis AI-assisted

CVE-2026-27767: SWITCH EV Swtchenergy.com Missing Authentication on OCPP WebSocket Endpoint

SWITCH EV Swtchenergy.com exposes WebSocket endpoints that lack proper authentication, as described in CVE-2026-27767 (CWE-306). According to the record, an unauthenticated attacker who knows or discovers a charging station identifier could impersonate a charger and exchange OCPP commands with the backend. The NVD base score is 9.8 (CVSS 3.1), and no confirmed exploitation appears in the sources consulted.

Published Oct 24, 2026 · Updated Oct 24, 2026 · Ler em português

Overview

SWITCH EV Swtchenergy.com is affected by CVE-2026-27767, classified as CWE-306 (Missing Authentication for Critical Function). The record states that WebSocket endpoints lack proper authentication, which allows an unauthenticated party to act as a charging station toward the backend that manages the charging infrastructure.

Impact

  • An attacker who knows or discovers a charging station identifier may connect to the OCPP WebSocket endpoint without credentials.
  • The record describes the possibility of issuing or receiving OCPP commands as a legitimate charger.
  • Potential consequences listed in the record include privilege escalation, unauthorized control of charging infrastructure and corruption of charging network data reported to the backend.
  • The NVD and CISA-related scores are 9.8 (CVSS 3.1, NVD), with CVSS 4.0 scores of 9.3 provided by ICS-CERT. The SSVC data indicates automatable exploitation potential and total technical impact.

Affected products and versions

  • SWITCH EV Swtchenergy.com: the record lists all versions as affected.
  • Swtchenergy Swtchenergy.com: the record states that versions are not specified by the source.

No specific version strings are provided in the available data, so this analysis does not list any version numbers. Organizations should confirm with the vendor which firmware or software builds are in use.

Exploitation status

The CISA KEV catalog does not list this CVE in the record. No confirmed exploitation appears in the sources consulted. The EPSS probability is 0.00984 (percentile 0.61991), and the SSVC exploitation field is recorded as none.

Remediation and mitigation

  • Contact the vendor through the listed channel at the vendor contact page to obtain guidance and any available updates. No fixed version is listed in the record, which does not mean no fix exists.
  • Restrict network access to OCPP WebSocket endpoints so that only authorized charging stations and backend systems can reach them.
  • Review and strengthen the identity verification of charging stations, including mutual authentication where the platform supports it.
  • Follow the guidance in the CISA ICS advisory ICSA-26-057-06.

Detection guidance

  • Monitor OCPP WebSocket connections for charging station identifiers that connect from unexpected networks or at unusual frequencies.
  • Alert on connections where station identifiers do not match registered hardware or commissioning records.
  • Review backend logs for unexpected status changes or commands that do not correspond to physical charger activity.

Limitations of the available information

  • The record does not specify affected or fixed versions for the product.
  • The vendor's own advisory text is not included in the record; the CISA advisory and CSAF file were referenced but their contents were not provided here.
  • Scores differ across CVSS versions and providers, and the record does not explain the differences.
  • Whether the product is deployed in a given environment, and how station identifiers are issued, is unknown from the record.

Frequently asked questions

What is the core weakness in CVE-2026-27767?

The record describes WebSocket endpoints that lack proper authentication (CWE-306), so an unauthenticated party may connect to the OCPP endpoint using a charging station identifier.

Is this CVE known to be actively exploited?

No. The CISA KEV entry is not listed in the record, and no confirmed exploitation appears in the sources consulted.

Which versions are affected?

The record lists all versions for the SWITCH EV product and states that versions are not specified by the source for the Swtchenergy product. No version numbers are provided.

Is there a fix available?

The record lists no fixed versions. This does not mean no fix exists; contact the vendor and review the CISA advisory for guidance.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.