Mobility46 mobility46.se 重要な機能における認証の欠如

The core of this vulnerability lies in the lack of authentication on the OCPP WebSocket endpoint. Attackers can connect using a known or discovered charging station identifier and issue commands as if they were a legitimate charger. This opens the door to a range of malicious activities. An attacker could manipulate charging sessions, alter reported energy consumption data, or even disable charging stations entirely. The potential for financial loss, reputational damage, and disruption of charging services is substantial. This vulnerability shares similarities with other authentication bypass flaws where lack of proper access controls allows for unauthorized actions, potentially impacting the entire charging network.

Organizations deploying Mobility46 OCPP WebSocket Service in charging infrastructure are at risk. This includes electric vehicle charging station operators, energy providers, and businesses with private charging networks. Shared hosting environments where multiple organizations share the same server infrastructure are particularly vulnerable, as a compromise of one tenant could potentially impact others.

• nodejs / server:

  lsof -i :9000  # Check for connections to the OCPP WebSocket port (adjust port as needed)
  netstat -an | grep :9000 # Alternative to lsof

• generic web:

  curl -I https://<your_ocpp_server>/ocpp/v1.6/ws  # Check for WebSocket endpoint exposure
  grep -r "ocpp/v1.6/ws" /var/log/nginx/access.log # Look for requests to the WebSocket endpoint in access logs

1. 2026-02-27Disclosure

   disclosure

1. 予約済み2026-02-24
2. 公開日2026-02-27
3. 更新日2026-04-08
4. EPSS 更新日2026-03-23

The primary mitigation for CVE-2026-27028 is to upgrade to a patched version of the Mobility46 OCPP WebSocket Service as soon as it becomes available. Until a patch is available, consider implementing temporary workarounds. These might include restricting access to the WebSocket endpoint to trusted networks or implementing a reverse proxy with authentication. Carefully review and restrict access to the OCPP WebSocket endpoint, limiting it to known and trusted charging stations. Monitor WebSocket traffic for suspicious activity, such as unexpected commands or connections from unknown sources. After upgrading, confirm the fix by attempting to connect to the WebSocket endpoint without authentication and verifying that access is denied.