CTEK Chargeportal Missing Authentication for Critical Function
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- High · High · Low
- Fix status
- No fix listed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-306.
Summary
WebSocket endpoints lack proper authentication mechanisms, enabling attackers to perform unauthorized station impersonation and manipulate data sent to the backend. An unauthenticated attacker can connect to the OCPP WebSocket endpoint using a known or discovered charging station identifier, then issue or receive OCPP commands as a legitimate charger. Given that no authentication is required, this can lead to privilege escalation, unauthorized control of charging infrastructure, and corruption of charging network data reported to the backend.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2026-25192
- 2026-10-03 Alias added: GHSA-gm9p-728x-c9h8
References
More CTEK Charge Portal vulnerabilities
- TI-2026-24455 CTEK Chargeportal Improper Restriction of Excessive Authentication Attempts CVSS 4.0HIGH 8.7
- TI-2026-22031 CTEK Chargeportal Insufficient Session Expiration CVSS 4.0MEDIUM 6.9
Sources
- CVE-2026-25192 · CVE Program
- CVE-2026-25192 · NVD
- FIRST EPSS
- GHSA-gm9p-728x-c9h8 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences