IGL-Technologies eParking.fi Missing Authentication for Critical Function
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- High · High · Low
- Fix status
- No fix listed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-306.
Summary
WebSocket endpoints lack proper authentication mechanisms, enabling attackers to perform unauthorized station impersonation and manipulate data sent to the backend. An unauthenticated attacker can connect to the OCPP WebSocket endpoint using a known or discovered charging station identifier, then issue or receive OCPP commands as a legitimate charger. Given that no authentication is required, this can lead to privilege escalation, unauthorized control of charging infrastructure, and corruption of charging network data reported to the backend.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| IGL-Technologies | eParking.fi | All versions | — | No fix listed | CNA |
- eParking.fi VendorIGL-Technologies Affected All versions Fixed in — No fix listed CNA
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:igl:eparking.fi:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | IGL-Technologies |
- cpe:2.3:a:igl:eparking.fi:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·IGL-Technologies
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2026-29796
- 2026-10-03 Alias added: GHSA-3pgw-qmv2-hv8m
- 2026-10-25 EPSS moved to the below the 50th percentile
References
More IGL-Technologies Eparking.fi vulnerabilities
- TI-2026-24454 IGL-Technologies eParking.fi Improper Restriction of Excessive Authentication Attempts CVSS 4.0HIGH 8.7
- TI-2026-25165 IGL-Technologies eParking.fi Insufficient Session Expiration CVSS 4.0MEDIUM 6.9
Sources
- CVE-2026-29796 · CVE Program
- CVE-2026-29796 · NVD
- FIRST EPSS
- GHSA-3pgw-qmv2-hv8m · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences