CVE-2026-24731: WebSocket Impersonation in ev2go.io

The vulnerability allows an attacker to connect to the OCPP WebSocket endpoint using a known or discovered charging station identifier without authentication. Subsequently, they can issue or receive OCPP commands as if they were a legitimate charger. This represents a significant privilege escalation risk, potentially granting attackers complete control over charging infrastructure. The attacker could manipulate charging sessions, alter reported data, and disrupt the charging network, leading to financial losses, reputational damage, and potentially even safety hazards. The lack of authentication makes exploitation relatively straightforward, increasing the potential for widespread abuse.

1. Reserved2026-02-23
2. Published2026-02-26
3. Modified2026-03-05
4. EPSS updated2026-03-23

The primary mitigation is to upgrade to a patched version of ev2go.io once available. Until then, implement temporary workarounds to limit the impact. A Web Application Firewall (WAF) or proxy server can be configured to restrict access to the OCPP WebSocket endpoint, requiring authentication or limiting access based on IP address or other criteria. Carefully review and restrict access to the OCPP WebSocket endpoint. Implement strict input validation on all OCPP commands received to prevent malicious payloads. Monitor network traffic for suspicious OCPP command patterns.