EV2GO ev2go.io Missing Authentication for Critical Function
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- High · High · Low
- Fix status
- No fix listed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-306.
Summary
WebSocket endpoints lack proper authentication mechanisms, enabling attackers to perform unauthorized station impersonation and manipulate data sent to the backend. An unauthenticated attacker can connect to the OCPP WebSocket endpoint using a known or discovered charging station identifier, then issue or receive OCPP commands as a legitimate charger. Given that no authentication is required, this can lead to privilege escalation, unauthorized control of charging infrastructure, and corruption of charging network data reported to the backend.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2026-24731
- 2026-10-03 Alias added: GHSA-627v-rfr6-xm8w
- 2026-10-24 EPSS moved to the 50th–90th percentile
References
More Ev2go.io vulnerabilities
- TI-2026-20973 EV2GO ev2go.io Improper Restriction of Excessive Authentication Attempts CVSS 4.0HIGH 8.7
- TI-2026-16921 EV2GO ev2go.io Insufficient Session Expiration CVSS 4.0MEDIUM 6.9
- TI-2026-18378 EV2GO ev2go.io Insufficiently Protected Credentials CVSS 4.0MEDIUM 6.9
Sources
- CVE-2026-24731 · CVE Program
- CVE-2026-24731 · NVD
- FIRST EPSS
- GHSA-627v-rfr6-xm8w · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences