CVE-2026-25192: WebSocket OCPP Auth Bypass Vulnerability

CVE-2026-25192 Overview

CVE-2026-25192 is a critical authentication bypass vulnerability affecting WebSocket endpoints in EV charging infrastructure. The vulnerability exists because WebSocket endpoints implementing the Open Charge Point Protocol (OCPP) lack proper authentication mechanisms, enabling attackers to perform unauthorized station impersonation and manipulate data sent to the backend systems.

An unauthenticated attacker can connect to the OCPP WebSocket endpoint using a known or discovered charging station identifier, then issue or receive OCPP commands as if they were a legitimate charger. Given that no authentication is required, this can lead to privilege escalation, unauthorized control of charging infrastructure, and corruption of charging network data reported to the backend.

Critical Impact

This vulnerability allows unauthenticated remote attackers to impersonate charging stations, issue unauthorized OCPP commands, and corrupt backend charging network data, potentially disrupting critical EV charging infrastructure.

Affected Products

• CTEK EV Charging Infrastructure (WebSocket OCPP endpoints)
• Systems implementing OCPP WebSocket communications without authentication
• Backend charging management systems connected via vulnerable endpoints

Discovery Timeline

• March 20, 2026 - CVE-2026-25192 published to NVD
• March 23, 2026 - Last updated in NVD database

Technical Details for CVE-2026-25192

Vulnerability Analysis

This vulnerability is classified under CWE-306 (Missing Authentication for Critical Function), which represents a fundamental security flaw where a system fails to perform any authentication before allowing access to critical functionality. In this case, the OCPP WebSocket endpoints accept connections and process commands without verifying the identity of the connecting party.

The OCPP (Open Charge Point Protocol) is a standard communication protocol between EV charging stations and central management systems. When implemented without proper authentication on WebSocket endpoints, any network-accessible attacker can establish a connection by simply knowing or guessing a valid charging station identifier.

Once connected, the attacker gains the ability to send and receive OCPP messages as if they were the legitimate charging station. This includes commands for starting/stopping charging sessions, reporting meter values, sending status notifications, and receiving firmware update instructions.

Root Cause

The root cause of this vulnerability is the absence of authentication mechanisms on the OCPP WebSocket endpoints. The implementation accepts WebSocket connections and processes OCPP commands based solely on the provided charging station identifier without verifying that the connecting client is actually the authorized charging station.

This design flaw violates the principle of defense in depth and fails to implement basic access control measures for critical infrastructure communications. The lack of mutual authentication, TLS client certificates, API keys, or token-based authentication allows any party with network access to impersonate charging stations.

Attack Vector

The attack vector for CVE-2026-25192 is network-based and requires no authentication or user interaction. An attacker can exploit this vulnerability through the following steps:

1. Reconnaissance: The attacker identifies or discovers valid charging station identifiers through network scanning, enumeration, or information disclosure
2. Connection Establishment: Using a WebSocket client, the attacker connects to the vulnerable OCPP endpoint, providing a valid station identifier
3. Station Impersonation: The backend system accepts the connection as legitimate, granting the attacker full OCPP communication capabilities
4. Malicious Operations: The attacker can now issue commands such as manipulating charging session data, sending false meter readings, triggering unauthorized actions, or intercepting commands meant for legitimate stations

The vulnerability can be exploited to disrupt charging operations, manipulate billing data, cause physical damage to connected vehicles or infrastructure through malicious charging parameters, or serve as a pivot point for deeper network intrusion.

Detection Methods for CVE-2026-25192

Indicators of Compromise

• Multiple WebSocket connections from different IP addresses using the same charging station identifier
• Anomalous OCPP message patterns or commands inconsistent with normal charging station behavior
• Geographic impossibilities where a single station identifier connects from disparate network locations
• Unusual timing patterns in OCPP communications, such as rapid reconnections or message flooding

Detection Strategies

• Implement network monitoring to track WebSocket connection sources and correlate with expected charging station network locations
• Deploy behavioral analysis to detect anomalous OCPP message sequences or volumes that deviate from established baselines
• Monitor for duplicate station identifier usage across different source IPs or network segments
• Review authentication logs for connection attempts lacking proper credentials after implementing authentication controls

Monitoring Recommendations

• Enable detailed logging of all OCPP WebSocket connections including source IP, timestamp, station identifier, and message types
• Establish baseline communication patterns for each charging station to enable anomaly detection
• Configure alerts for suspicious connection patterns such as rapid reconnections or connections from unexpected network ranges
• Implement network segmentation monitoring to detect lateral movement attempts from compromised charging infrastructure

How to Mitigate CVE-2026-25192

Immediate Actions Required

• Contact CTEK through their support page for vendor-specific remediation guidance and available patches
• Implement network segmentation to restrict access to OCPP WebSocket endpoints from untrusted networks
• Deploy Web Application Firewall (WAF) rules to filter unauthorized WebSocket connection attempts
• Enable comprehensive logging on all OCPP communications for forensic purposes and threat detection
• Review the CISA ICS Advisory for additional guidance specific to industrial control system environments

Patch Information

Organizations should consult the CISA ICS Advisory ICSA-26-078-06 for detailed remediation guidance. The GitHub CSAF file contains structured vulnerability information in Common Security Advisory Framework format. Contact CTEK through their official support channels for firmware updates and configuration guidance specific to affected products.

Workarounds

• Implement TLS client certificate authentication to verify charging station identities before accepting WebSocket connections
• Deploy a VPN or encrypted tunnel for OCPP communications, ensuring only authenticated endpoints can connect
• Restrict WebSocket endpoint access to known IP addresses or network ranges associated with legitimate charging stations
• Implement token-based authentication or API keys as an additional layer of identity verification
• Consider deploying a reverse proxy with authentication capabilities in front of vulnerable OCPP endpoints

# Example: Restrict WebSocket access using iptables (Linux)
# Allow connections only from known charging station IP ranges
iptables -A INPUT -p tcp --dport 9000 -s 10.10.0.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 9000 -j DROP

# Example: Enable TLS on nginx reverse proxy for OCPP WebSocket
# Configure in /etc/nginx/conf.d/ocpp-proxy.conf
# ssl_client_certificate /etc/nginx/certs/charging-stations-ca.crt;
# ssl_verify_client on;