CVE Intelligence
Analysis AI-assisted

CVE-2026-27772: EV Energy ev.energy Missing Authentication on WebSocket OCPP Endpoint

CVE-2026-27772 affects the ev.energy product from EV Energy and is classified as missing authentication for a critical function (CWE-306). According to the record, the OCPP WebSocket endpoint can be reached without authentication, which may allow an unauthenticated party to impersonate a charging station. The NVD base score is 9.8, and the sources consulted do not show confirmed exploitation.

Published Oct 24, 2026 · Updated Oct 24, 2026 · Ler em português

Overview

CVE-2026-27772 is a missing authentication issue (CWE-306) in the ev.energy product from EV Energy. According to the record, the WebSocket endpoints, including the OCPP endpoint used for charging station communication, do not enforce proper authentication. The NVD record status is Modified, and the CVE was published through the ICS-CERT CNA.

Impact

  • An unauthenticated party may be able to impersonate a charging station.
  • Data sent to the backend may be manipulated.
  • The record describes possible privilege escalation and unauthorized control of charging infrastructure.
  • Corruption of charging network data reported to the backend is possible.

Affected products and versions

  • Listed product: Ev.energy Ev.energy from EV Energy.
  • The record does not specify numbered versions. It describes the affected scope only as all versions, without a list of releases.
  • No fixed version is listed in the record. This does not confirm that no fix exists.

Exploitation status

The CISA KEV entry in the record is not listed. The SSVC data reports exploitation as none and automatable as yes. No confirmed active exploitation appears in the sources consulted.

Remediation and mitigation

  • Review the CISA advisory and the vendor website for current guidance from the manufacturer.
  • Restrict network access to charging management and OCPP endpoints so that only trusted networks and known backend systems can reach them.
  • Apply authentication and server-side verification of station identity for WebSocket sessions, as a defensive design principle.
  • Maintain an inventory of charging stations and treat unregistered identifiers as suspicious.

Detection guidance

  • Review logs for WebSocket sessions from unknown or unregistered station identifiers.
  • Alert on charger sessions that do not match the asset inventory or that change identity unexpectedly.
  • Watch backend records for unusual message volumes or data inconsistencies that could indicate tampering.

Limitations of the available information

The record does not provide numbered affected versions, fixed versions, or technical details about the endpoints. The exact deployment conditions that make a system vulnerable are unknown. CVSS scores differ between providers in the record. The guidance above is generic and should be checked against the vendor and CISA advisories.

Frequently asked questions

What is CVE-2026-27772?

It is a missing authentication issue (CWE-306) in the ev.energy product from EV Energy, affecting WebSocket endpoints including the OCPP endpoint used by charging stations.

Is this vulnerability being actively exploited?

The CISA KEV entry in the record is not listed, and no confirmed active exploitation appears in the sources consulted.

Which versions are affected and is there a fix?

The record does not list numbered affected versions or fixed versions. The absence of a fixed version in the record does not mean no fix exists, so check the vendor and CISA advisories.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.