EUVD-2025-208479

A vulnerability has been identified in Heliox Flex 180 kW EV Charging Station All versions F4.11.1, Heliox Mobile DC 40 kW EV Charging Station All versions L4.10.1. Affected devices contain improper access control that could allow an attacker to reach unauthorized services via the charging cable...

CVE-2025-27769

A vulnerability has been identified in Heliox Flex 180 kW EV Charging Station All versions F4.11.1, Heliox Mobile DC 40 kW EV Charging Station All versions L4.10.1. Affected devices contain improper access control that could allow an attacker to reach unauthorized services via the charging cable...

CVE-2025-27769

A vulnerability has been identified in Heliox Flex 180 kW EV Charging Station All versions F4.11.1, Heliox Mobile DC 40 kW EV Charging Station All versions L4.10.1. Affected devices contain improper access control that could allow an attacker to reach unauthorized services via the charging cable...

Siemens Heliox EV Chargers Access Control Vulnerability

The Heliox Flex 180 kW EV Charging Station is a modular DC fast charging device in the Heliox series from Siemens.Heliox Mobile DC 40 kW EV Charging Station is a portable, plug-and-play fast charging device for electric vehicles from the Heliox brand of Siemens. The Heliox Mobile DC 40 kW EV...

PT-2026-24216

Name of the Vulnerable Software and Affected Versions Heliox Flex 180 kW EV Charging Station versions prior to F4.11.1 Heliox Mobile DC 40 kW EV Charging Station versions prior to L4.10.1 Description The charging stations have improper access control. This could allow an attacker to reach...

CVE-2026-27027

Charging station authentication identifiers are publicly accessible via web-based mapping platforms...

CVE-2026-27777

Charging station authentication identifiers are publicly accessible via web-based mapping platforms...

CVE-2026-26051

WebSocket endpoints lack proper authentication mechanisms, enabling attackers to perform unauthorized station impersonation and manipulate data sent to the backend. An unauthenticated attacker can connect to the OCPP WebSocket endpoint using a known or discovered charging station identifier, then...

CVE-2026-27770

Charging station authentication identifiers are publicly accessible via web-based mapping platforms...

CVE-2026-24912

The WebSocket backend uses charging station identifiers to uniquely associate sessions but allows multiple endpoints to connect using the same session identifier. This implementation results in predictable session identifiers and enables session hijacking or shadowing, where the most recent...

CVE-2026-22552

WebSocket endpoints lack proper authentication mechanisms, enabling attackers to perform unauthorized station impersonation and manipulate data sent to the backend. An unauthenticated attacker can connect to the OCPP WebSocket endpoint using a known or discovered charging station identifier, then...

EUVD-2026-10041

Charging station authentication identifiers are publicly accessible via web-based mapping platforms...

EUVD-2026-10035

WebSocket endpoints lack proper authentication mechanisms, enabling attackers to perform unauthorized station impersonation and manipulate data sent to the backend. An unauthenticated attacker can connect to the OCPP WebSocket endpoint using a known or discovered charging station identifier, then...

EUVD-2026-10036

Charging station authentication identifiers are publicly accessible via web-based mapping platforms...

EUVD-2026-10031

The WebSocket backend uses charging station identifiers to uniquely associate sessions but allows multiple endpoints to connect using the same session identifier. This implementation results in predictable session identifiers and enables session hijacking or shadowing, where the most recent...

CVE-2026-27764

The WebSocket backend uses charging station identifiers to uniquely associate sessions but allows multiple endpoints to connect using the same session identifier. This implementation results in predictable session identifiers and enables session hijacking or shadowing, where the most recent...

CVE-2026-27777

Charging station authentication identifiers are publicly accessible via web-based mapping platforms...

CVE-2026-26288

WebSocket endpoints lack proper authentication mechanisms, enabling attackers to perform unauthorized station impersonation and manipulate data sent to the backend. An unauthenticated attacker can connect to the OCPP WebSocket endpoint using a known or discovered charging station identifier, then...

CVE-2026-27027

Charging station authentication identifiers are publicly accessible via web-based mapping platforms...

EUVD-2026-10034

WebSocket endpoints lack proper authentication mechanisms, enabling attackers to perform unauthorized station impersonation and manipulate data sent to the backend. An unauthenticated attacker can connect to the OCPP WebSocket endpoint using a known or discovered charging station identifier, then...