CTEK Chargeportal Missing Authentication for Critical Function

The primary impact of CVE-2026-25192 is the ability for an unauthenticated attacker to connect to the OCPP WebSocket endpoint. By leveraging a known or discovered charging station identifier, the attacker can then issue and receive OCPP commands as if they were a legitimate charging station. This effectively grants them unauthorized control over the charging infrastructure. The consequences are severe: attackers could manipulate charging sessions, alter billing data, disrupt charging operations, and potentially compromise the integrity of the entire charging network. The lack of authentication makes this vulnerability particularly dangerous, as it bypasses standard security controls and allows for easy exploitation.

Organizations deploying Chargeportal in environments with limited network segmentation are particularly at risk. Shared hosting environments where multiple charging stations share the same Chargeportal instance are also vulnerable, as an attacker compromising one station could potentially gain access to others. Legacy Chargeportal deployments with outdated configurations and inadequate security controls are also at heightened risk.

• other / supply-chain: Monitor network traffic for unauthorized connections to the OCPP WebSocket endpoint. Examine Chargeportal logs for suspicious activity, particularly connections from unknown IP addresses or using unusual charging station identifiers.

# Example: Monitor for connections to the OCPP WebSocket port (typically 9000)
sudo tcpdump -i any port 9000 | grep -i 'chargeportal'

1. 2026-03-20Disclosure

   disclosure

1. 已保留2026-03-12
2. 发布日期2026-03-20
3. 修改日期2026-03-23
4. EPSS 更新日期2026-03-28

The primary mitigation for CVE-2026-25192 is to upgrade to a patched version of Chargeportal as soon as it becomes available. Until a patch is deployed, implement immediate workarounds to limit the potential impact. Network segmentation is crucial; isolate the Chargeportal server from other critical systems to limit lateral movement. Strict firewall rules should be enforced to restrict access to the OCPP WebSocket endpoint, allowing only authorized connections from known and trusted sources. Consider implementing rate limiting on the WebSocket endpoint to mitigate potential denial-of-service attacks. After applying any mitigations, verify functionality by attempting to connect to the OCPP WebSocket endpoint with an unauthorized identifier and confirming that access is denied.