CVE-2026-20744 Overview
CVE-2026-20744 is a missing authentication vulnerability [CWE-284] affecting a charging station WebSocket endpoint. The endpoint accepts incoming WebSocket connections without validating client credentials. An unauthenticated network attacker can connect directly to the endpoint and issue commands that lead to privilege escalation on the affected device.
The issue was disclosed through a CISA Industrial Control Systems advisory (ICSA-26-188-01) referencing Hydro-Québec as the coordinating contact. The vulnerability is network-reachable, requires no user interaction, and affects confidentiality, integrity, and availability of the charging station.
Critical Impact
An unauthenticated attacker with network access to the charging station WebSocket endpoint can escalate privileges and take full control of the device.
Affected Products
- Charging station firmware exposing an unauthenticated WebSocket endpoint (see CISA advisory ICSA-26-188-01)
- Operational Technology (OT) electric vehicle supply equipment (EVSE) referenced in the Hydro-Québec CSAF disclosure
- Deployments where the charging station WebSocket interface is reachable from untrusted networks
Discovery Timeline
- 2026-07-10 - CVE-2026-20744 published to the National Vulnerability Database
- 2026-07-14 - Entry last modified in NVD
Technical Details for CVE-2026-20744
Vulnerability Analysis
The charging station exposes a WebSocket endpoint intended for management or telemetry communication. This endpoint does not enforce authentication on incoming connections. Any network client capable of completing the WebSocket handshake can establish a session and interact with the underlying application layer.
Once connected, the attacker can invoke protocol messages that operate at higher privilege than an unauthenticated client should possess. The result is privilege escalation, giving the attacker control over functions normally reserved for authenticated administrators or backend systems.
The weakness maps to [CWE-284] Improper Access Control. Because charging stations often bridge public networks and internal energy infrastructure, exploitation can affect billing, session control, firmware handling, and physical charging behavior.
Root Cause
The root cause is the absence of an authentication step during the WebSocket upgrade and message handling phases. The server accepts the HTTP upgrade request and processes subsequent frames without verifying a token, certificate, or session credential. Authorization checks on individual actions rely on the assumption that the transport is trusted, which is not enforced.
Attack Vector
The attack vector is network based. An attacker with reachability to the WebSocket listener sends a standard ws:// or wss:// upgrade request, then transmits application-layer messages that trigger privileged operations. No credentials, prior compromise, or user interaction is required.
No public proof-of-concept exploit is listed in the referenced advisories. The current EPSS score is 0.519% (percentile 40.742). Technical details of the message format are described in the CISA ICS Advisory ICSA-26-188-01 and the corresponding GitHub CSAF File.
Detection Methods for CVE-2026-20744
Indicators of Compromise
- WebSocket upgrade requests to the charging station management endpoint from unexpected source IP addresses or geolocations
- Sessions initiated on the WebSocket port without a preceding authentication exchange or valid client certificate
- Command or configuration messages issued from clients that never presented credentials
- Unexpected firmware, configuration, or charging session state changes on the device
Detection Strategies
- Baseline the set of legitimate management hosts that connect to the charging station WebSocket endpoint and alert on deviations
- Inspect network traffic for Upgrade: websocket requests reaching OT devices from outside the management VLAN
- Correlate device audit logs with authentication events to identify privileged actions that lack a corresponding login
Monitoring Recommendations
- Forward charging station and network logs to a centralized SIEM for retention and correlation
- Monitor for administrative or firmware-related commands originating from the WebSocket channel
- Alert on repeated WebSocket connection attempts from unauthorized subnets or public IP ranges
How to Mitigate CVE-2026-20744
Immediate Actions Required
- Restrict network access to the charging station WebSocket endpoint using firewall rules or ACLs so only trusted management hosts can reach it
- Place charging stations on a segmented OT network isolated from corporate and internet-facing zones
- Audit recent WebSocket connection logs for unauthorized activity and privileged actions
- Contact the vendor or Hydro-Québec via the Hydro-Québec Contact Page for firmware guidance
Patch Information
No fixed version is listed in the NVD entry at the time of publication. Refer to the CISA ICS Advisory ICSA-26-188-01 and the GitHub CSAF File for the current vendor remediation status and firmware update instructions.
Workarounds
- Terminate WebSocket connections from unauthorized networks at an upstream reverse proxy that enforces mutual TLS or token authentication
- Disable the WebSocket endpoint on devices that do not require remote management until a patched firmware is available
- Deploy a VPN or zero-trust network access gateway in front of the charging station management interface
- Rotate any shared secrets, API keys, or backend credentials used by the charging station following exposure review
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
