CVE-2026-27772 is a critical vulnerability affecting all versions of ev.energy's charging infrastructure software. It stems from a lack of authentication on WebSocket endpoints, allowing attackers to impersonate charging stations and manipulate data. This can result in unauthorized control of charging infrastructure and corruption of data reported to the backend, posing a significant risk to charging networks.
The primary impact of CVE-2026-27772 is the potential for unauthorized control of charging stations. An attacker can connect to the OCPP WebSocket endpoint using a known or discovered charging station identifier and issue commands as if they were a legitimate charger. This could involve manipulating charging rates, disconnecting vehicles prematurely, or even preventing legitimate users from accessing charging services. Furthermore, the ability to receive OCPP commands allows attackers to intercept and potentially alter data transmitted between the charging station and the backend system, leading to inaccurate billing, reporting, and potentially even the injection of malicious code. The blast radius extends to the entire charging network, as a compromised station can impact the integrity of the entire system’s data.
CVE-2026-27772 was publicly disclosed on 2026-02-27. The vulnerability's criticality (CVSS 9.4) and ease of exploitation (no authentication required) suggest a high probability of exploitation. While no public proof-of-concept (PoC) has been released as of this writing, the lack of authentication makes it a prime target for automated scanning and exploitation. It is recommended to monitor threat intelligence feeds for any indications of active campaigns targeting ev.energy infrastructure.
Organizations deploying ev.energy charging infrastructure are at risk, particularly those with publicly accessible charging stations or those lacking robust network segmentation. Shared hosting environments where multiple charging stations share a single IP address are also at increased risk, as a compromise of one station could potentially expose others. Legacy deployments using older, unpatched versions of ev.energy are especially vulnerable.
• linux / server: Monitor OCPP WebSocket traffic for connections originating from unexpected IP addresses or lacking proper authentication headers. Use tcpdump or wireshark to capture and analyze WebSocket payloads for suspicious commands.
tcpdump -i any port 9000 -w capture.pcap• generic web: Check for exposed OCPP WebSocket endpoints by attempting to connect to ws://<chargingstationip>:9000/ without authentication. Analyze access logs for unusual connection patterns.
curl -v ws://<charging_station_ip>:9000/disclosure
エクスプロイト状況
EPSS
0.13% (32% パーセンタイル)
CISA SSVC
CVSS ベクトル
The immediate mitigation is to upgrade to a patched version of ev.energy as soon as it becomes available. Until then, implement strict Web Application Firewall (WAF) rules to filter unauthorized OCPP commands and restrict access to the WebSocket endpoint. Consider implementing OCPP protocol validation to ensure commands adhere to expected formats and parameters. Network segmentation can also limit the potential impact of a compromised station. Monitor WebSocket traffic for unusual activity, such as commands originating from unexpected sources or exhibiting anomalous patterns. After implementing mitigations, verify their effectiveness by attempting to connect to the WebSocket endpoint without proper authentication and confirming that access is denied.
WebSocket エンドポイントに堅牢な認証メカニズムを実装してください。 すべてのリクエストを処理する前に検証および承認してください。 充電器の身元を確認するために、デジタル証明書または認証トークンの使用を検討してください。
脆弱性分析と重要アラートをメールでお届けします。
CVE-2026-27772 is a critical vulnerability in ev.energy's charging infrastructure that allows unauthenticated attackers to impersonate charging stations and manipulate data via WebSocket endpoints, potentially leading to unauthorized control and data corruption.
Yes, all versions of ev.energy are affected by this vulnerability. If you are using ev.energy charging infrastructure, you are potentially at risk.
The primary fix is to upgrade to a patched version of ev.energy as soon as it becomes available. Until then, implement WAF rules and OCPP protocol validation as interim mitigations.
While no public exploits are currently known, the vulnerability's criticality and ease of exploitation suggest a high probability of exploitation. Monitor threat intelligence feeds for any indications of active campaigns.
Please refer to the official ev.energy security advisory for detailed information and updates regarding CVE-2026-27772.
依存関係ファイルをアップロードすれば、このCVEや他のCVEがあなたに影響するか即座にわかります。