CVE-2026-40702: Missing Authentication in Charging Station WebSocket Endpoints
Missing authentication on WebSocket endpoints could allow attackers to impersonate charging stations. The CNA rates the issue critical, with a CVSS 3.1 base score of 9.4. The record lists no affected or fixed versions.
Overview
This record describes WebSocket endpoints that lack proper authentication, which would allow an attacker to impersonate charging stations. The weakness is classified as CWE-306, Missing Authentication for Critical Function. The record was published on 2026-06-25 and assigned by ICS-CERT.
Impact
According to the description, an attacker could gain unauthorized access to sensitive data or perform unauthorized actions. Because no authentication is required, the description states this could lead to privilege escalation and potentially compromise the security of the entire system. The CVSS 3.1 base score is 9.4 (critical), and the CVSS 4.0 score listed is 9.3.
Affected products and versions
The record does not list any affected products or versions. It includes a link to a contact page for Evoke Systems, but the record does not state that this vendor's product is affected.
Exploitation status
The record shows this CVE is not listed in the CISA Known Exploited Vulnerabilities catalog. No confirmed exploitation appears in the sources consulted.
Remediation and mitigation
- Review the CISA advisory ICSA-26-176-02 for the current guidance from the agency.
- Ask the product vendor for patch or fix information, since the record does not identify a fixed version.
- Limit network exposure of charging station WebSocket interfaces and place them behind network segmentation.
- Where the product does not enforce authentication, consider compensating controls that restrict access to trusted hosts.
Detection guidance
- Review logs for WebSocket connections to charging infrastructure that come from unexpected sources.
- Monitor for sessions presented as charging stations that originate from unknown or unauthorized addresses.
Limitations of the available information
The record contains no affected versions, fixed versions, EPSS score or SSVC data. It is unknown whether the referenced vendor contact page relates to the affected product. The full scope of the affected devices is not confirmed by the record.
Frequently asked questions
What is the core weakness in CVE-2026-40702?
The WebSocket endpoints lack proper authentication, which the record says lets attackers impersonate charging stations. The weakness is mapped to CWE-306, Missing Authentication for Critical Function.
How severe is this CVE according to the record?
The record lists a CVSS 3.1 base score of 9.4 and a CVSS 4.0 score of 9.3, both critical. These scores come from the CNA ICS-CERT.
Is there a fixed version or patch available?
The record does not list any fixed versions or patches. The absence of data in the record does not confirm that no fix exists, so contact the vendor and review the CISA advisory.
This analysis was drafted with AI assistance from verified source data and automatically checked against it.