CVE-2026-24731: Ev2go.io Privilege Escalation Vulnerability

CVE-2026-24731 Overview

CVE-2026-24731 is a critical authentication bypass vulnerability affecting the ev2go.io EV charging infrastructure platform. The vulnerability exists in WebSocket endpoints that lack proper authentication mechanisms, enabling attackers to perform unauthorized station impersonation and manipulate data sent to the backend.

An unauthenticated attacker can connect to the OCPP (Open Charge Point Protocol) WebSocket endpoint using a known or discovered charging station identifier, then issue or receive OCPP commands as a legitimate charger. Given that no authentication is required, this can lead to privilege escalation, unauthorized control of charging infrastructure, and corruption of charging network data reported to the backend.

Critical Impact

Unauthenticated attackers can impersonate EV charging stations, issue unauthorized commands, and corrupt backend charging network data, potentially disrupting critical infrastructure operations.

Affected Products

• ev2go ev2go.io

Discovery Timeline

• 2026-02-27 - CVE CVE-2026-24731 published to NVD
• 2026-03-05 - Last updated in NVD database

Technical Details for CVE-2026-24731

Vulnerability Analysis

This vulnerability is classified under CWE-306 (Missing Authentication for Critical Function), representing a fundamental security design flaw in the ev2go.io charging infrastructure platform. The OCPP WebSocket endpoints, which serve as the communication channel between charging stations and the central management backend, do not implement proper authentication mechanisms.

The network-accessible nature of these WebSocket endpoints, combined with the complete absence of authentication requirements, creates a severe attack surface. Attackers with network access can establish WebSocket connections to the OCPP endpoints using only a charging station identifier, which may be discoverable through various reconnaissance techniques or simply guessed based on predictable naming conventions.

Root Cause

The root cause of CVE-2026-24731 is the missing authentication mechanism for critical WebSocket endpoints in the OCPP implementation. The ev2go.io platform fails to validate the identity of connecting clients before allowing them to participate in the OCPP communication protocol. This design oversight allows any network-connected entity to assume the identity of a legitimate charging station by simply providing a valid or discovered station identifier.

Attack Vector

The attack vector is network-based and requires no prior authentication or user interaction. An attacker can exploit this vulnerability by:

1. Discovering or guessing valid charging station identifiers used by the ev2go.io infrastructure
2. Establishing a WebSocket connection to the OCPP endpoint using the discovered identifier
3. Impersonating the legitimate charging station to send malicious commands or receive sensitive operational data
4. Manipulating charging session data, billing information, or station status reports sent to the backend management system

The vulnerability enables both passive reconnaissance (receiving commands meant for legitimate stations) and active attacks (sending falsified data or commands to the backend).

Detection Methods for CVE-2026-24731

Indicators of Compromise

• Multiple WebSocket connections from different source IP addresses using the same charging station identifier
• Unusual patterns of OCPP commands or responses that deviate from normal station behavior profiles
• Connection attempts to OCPP endpoints from IP ranges outside expected geographic locations or network segments
• Inconsistent station telemetry data suggesting potential data manipulation or injection

Detection Strategies

• Implement network monitoring to track all WebSocket connections to OCPP endpoints, logging source IPs and station identifiers
• Deploy anomaly detection systems to identify unusual OCPP command patterns or frequency deviations
• Cross-reference WebSocket connection sources with known legitimate charging station network locations
• Monitor for duplicate station identifier usage across different network sources

Monitoring Recommendations

• Enable verbose logging on OCPP WebSocket servers to capture all connection attempts and command exchanges
• Implement real-time alerting for concurrent connections using identical station identifiers
• Establish baseline behavior profiles for each charging station to detect anomalous activity
• Review backend data integrity logs for signs of manipulation or inconsistent reporting

How to Mitigate CVE-2026-24731

Immediate Actions Required

• Restrict network access to OCPP WebSocket endpoints using firewall rules or network segmentation
• Implement IP allowlisting for known, legitimate charging station network addresses where feasible
• Enable enhanced logging and monitoring on all OCPP endpoints to detect exploitation attempts
• Review existing charging station data for signs of tampering or manipulation

Patch Information

Organizations should monitor the CISA ICS Advisory #26-057-04 and the ev2go vendor page for official security patches and remediation guidance. Additional technical details are available in the GitHub CSAF File.

Workarounds

• Deploy a VPN or secure tunnel requirement for all OCPP WebSocket communications until authentication can be implemented
• Implement certificate-based mutual TLS (mTLS) authentication at the network layer as a compensating control
• Segment the charging network infrastructure to limit attacker lateral movement capabilities
• Consider implementing application-layer authentication mechanisms such as OCPP security profiles if supported

# Network segmentation example - restrict OCPP endpoint access
# Allow only known charging station subnets to connect to OCPP WebSocket ports
iptables -A INPUT -p tcp --dport 9000 -s 10.100.0.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 9000 -j DROP