CVE-2026-27772: Ev.energy Auth Bypass Vulnerability

CVE-2026-27772 Overview

CVE-2026-27772 is a critical authentication bypass vulnerability affecting the ev.energy electric vehicle charging infrastructure platform. The WebSocket endpoints used for OCPP (Open Charge Point Protocol) communication lack proper authentication mechanisms, enabling attackers to perform unauthorized station impersonation and manipulate data sent to the backend.

An unauthenticated attacker can connect to the OCPP WebSocket endpoint using a known or discovered charging station identifier, then issue or receive OCPP commands as a legitimate charger. Given that no authentication is required, this can lead to privilege escalation, unauthorized control of charging infrastructure, and corruption of charging network data reported to the backend.

Critical Impact

Unauthenticated network attackers can impersonate legitimate EV charging stations, issue unauthorized OCPP commands, manipulate charging infrastructure operations, and corrupt backend reporting data without any credentials.

Affected Products

• ev.energy ev.energy (all versions)
• OCPP WebSocket endpoints in ev.energy charging management platform
• Backend systems receiving OCPP protocol communications

Discovery Timeline

• 2026-02-27 - CVE-2026-27772 published to NVD
• 2026-03-05 - Last updated in NVD database

Technical Details for CVE-2026-27772

Vulnerability Analysis

This vulnerability falls under CWE-306 (Missing Authentication for Critical Function), a significant security weakness where critical functionality is exposed without requiring proper authentication. The ev.energy platform's OCPP WebSocket endpoints accept connections from any client that presents a valid charging station identifier, without verifying the identity of the connecting party.

The OCPP protocol is designed to facilitate communication between EV charging stations and central management systems. In properly secured implementations, mutual authentication ensures that only legitimate charging stations can connect to the backend. However, the vulnerable ev.energy implementation allows any attacker with network access to establish a WebSocket connection by simply knowing or guessing a station identifier.

Root Cause

The root cause is the absence of authentication mechanisms on the OCPP WebSocket endpoints. The system relies solely on the charging station identifier for identification purposes without implementing any form of credential verification, certificate-based authentication, or token validation. This design flaw violates fundamental security principles for critical infrastructure communication protocols.

Station identifiers may be discoverable through various means including physical inspection of charging stations, enumeration attacks, or information disclosure through other system interfaces. Once an identifier is obtained, an attacker has everything needed to impersonate that station.

Attack Vector

The attack vector is network-based, requiring the attacker to have network connectivity to the OCPP WebSocket endpoint. The attack can be executed remotely without any user interaction and requires no prior authentication or special privileges.

An attacker can exploit this vulnerability by establishing a WebSocket connection to the OCPP endpoint using a valid or discovered charging station identifier. Once connected, the attacker can send arbitrary OCPP messages to the backend system, including commands that would normally only originate from legitimate charging infrastructure. The attacker can also intercept or modify data intended for the actual charging station.

The attack flow involves identifying a target charging station identifier, initiating a WebSocket connection to the OCPP endpoint using that identifier, and then issuing OCPP commands such as status updates, transaction reports, or configuration changes. This can result in billing fraud, service disruption, or manipulation of charging network operations.

Detection Methods for CVE-2026-27772

Indicators of Compromise

• Multiple simultaneous connections from different IP addresses using the same charging station identifier
• Anomalous OCPP message patterns or frequencies from specific station identifiers
• Geographic inconsistencies between connection source IP and physical station location
• Unexpected status changes or transaction reports from charging stations

Detection Strategies

• Implement logging and monitoring of all OCPP WebSocket connection attempts with source IP tracking
• Deploy anomaly detection to identify unusual connection patterns or message sequences
• Monitor for concurrent sessions using identical station identifiers from different network locations
• Correlate network connection data with expected physical station behavior patterns

Monitoring Recommendations

• Enable comprehensive logging on OCPP WebSocket endpoints including connection metadata
• Establish baseline behavioral patterns for each charging station to detect deviations
• Configure alerts for connection attempts from unexpected IP ranges or geographic locations
• Review OCPP transaction logs regularly for inconsistencies that may indicate impersonation attacks

How to Mitigate CVE-2026-27772

Immediate Actions Required

• Contact ev.energy for information on available security patches or updates
• Implement network segmentation to restrict access to OCPP WebSocket endpoints
• Deploy Web Application Firewall (WAF) rules to filter unauthorized connection attempts
• Enable enhanced logging and monitoring on all charging infrastructure communications

Patch Information

Organizations should consult the CISA ICS Advisory for official guidance and remediation information. Additional technical details are available in the GitHub CSAF JSON File. Contact the vendor through the EV Energy Homepage for patch availability and support.

Workarounds

• Implement network access controls to restrict OCPP endpoint access to known charging station IP addresses only
• Deploy a VPN or private network for charging station communications to prevent unauthorized network access
• Consider implementing a reverse proxy with additional authentication layers in front of the OCPP endpoints
• If possible, implement mutual TLS (mTLS) certificate authentication at the network layer as an additional control

# Example network segmentation configuration (firewall rules)
# Restrict OCPP WebSocket endpoint access to known charging station IPs
# Replace OCPP_ENDPOINT_IP and STATION_IP_RANGE with actual values
iptables -A INPUT -p tcp --dport 443 -s STATION_IP_RANGE -d OCPP_ENDPOINT_IP -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -d OCPP_ENDPOINT_IP -j DROP