Mobility46 mobility46.se Missing Authentication for Critical Function
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- High · High · Low
- Fix status
- No fix listed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-306.
Summary
WebSocket endpoints lack proper authentication mechanisms, enabling attackers to perform unauthorized station impersonation and manipulate data sent to the backend. An unauthenticated attacker can connect to the OCPP WebSocket endpoint using a known or discovered charging station identifier, then issue or receive OCPP commands as a legitimate charger. Given that no authentication is required, this can lead to privilege escalation, unauthorized control of charging infrastructure, and corruption of charging network data reported to the backend.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Mobility46 | mobility46.se | All versions | — | No fix listed | CNA |
- mobility46.se VendorMobility46 Affected All versions Fixed in — No fix listed CNA
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:mobility46:mobility46.se:*:*:*:*:*:*:*:* | all versions | Vulnerable | Mobility46 |
- cpe:2.3:a:mobility46:mobility46.se:*:*:*:*:*:*:*:* Versions all versions Vulnerable ·Mobility46
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2026-27028
- 2026-10-03 Alias added: GHSA-q5w5-mh63-4m89
- 2026-10-25 EPSS moved to the below the 50th percentile
References
More Mobility46.se vulnerabilities
- TI-2026-21261 Mobility46 mobility46.se Improper Restriction of Excessive Authentication Attempts CVSS 4.0HIGH 8.7
- TI-2026-22029 Mobility46 mobility46.se Insufficient Session Expiration CVSS 4.0MEDIUM 6.9
- TI-2026-18369 Mobility46 mobility46.se Insufficiently Protected Credentials CVSS 4.0MEDIUM 6.9
Sources
- CVE-2026-27028 · CVE Program
- CVE-2026-27028 · NVD
- FIRST EPSS
- GHSA-q5w5-mh63-4m89 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences