90 matches found
CVE-2026-27767
The CVE-2026-27767 issue concerns WebSocket endpoints used for Open Charge Point Protocol (OCPP) in charging-station infrastructure. The underlying vulnerability is lack of authentication on these endpoints, allowing an unauthenticated attacker to connect with a known or discovered charging-stati...
CVE-2026-20781
WebSocket endpoints lack proper authentication mechanisms, enabling attackers to perform unauthorized station impersonation and manipulate data sent to the backend. An unauthenticated attacker can connect to the OCPP WebSocket endpoint using a known or discovered charging station identifier, then...
CVE-2025-68138
EVerest is an EV charging software stack, and EVerest libocpp is a C++ implementation of the Open Charge Point Protocol. In libocpp prior to version 0.30.1, pointers returned by the strdup calls are never freed. At each connection attempt, the newly allocated memory area will be leaked, potential...
CVE-2025-68138
EVerest is an EV charging software stack, and EVerest libocpp is a C++ implementation of the Open Charge Point Protocol. In libocpp prior to version 0.30.1, pointers returned by the strdup calls are never freed. At each connection attempt, the newly allocated memory area will be leaked, potential...
EUVD-2025-206321
EVerest is an EV charging software stack, and EVerest libocpp is a C++ implementation of the Open Charge Point Protocol. In libocpp prior to version 0.30.1, pointers returned by the strdup calls are never freed. At each connection attempt, the newly allocated memory area will be leaked, potential...
CVE-2025-68138 EVerest affected by memory exhaustion in libocpp
EVerest is an EV charging software stack, and EVerest libocpp is a C++ implementation of the Open Charge Point Protocol. In libocpp prior to version 0.30.1, pointers returned by the strdup calls are never freed. At each connection attempt, the newly allocated memory area will be leaked, potential...
CVE-2023-49958
An issue was discovered in Dalmann OCPP.Core through 1.2.0 for OCPP Open Charge Point Protocol for electric vehicles. The server processes mishandle StartTransaction messages containing additional, arbitrary properties, or duplicate properties. The last occurrence of a duplicate property is...
CVE-2026-22539
As the service interaction is performed without authentication, an attacker with some knowledge of the protocol could obtain information about the charger via OCPP v1.6...
PT-2026-2202
Name of the Vulnerable Software and Affected Versions OCPP versions 1.6 affected versions not specified Description The service interaction is performed without authentication, potentially allowing an attacker with protocol knowledge to obtain information about the charger. Recommendations At the...
EUVD-2018-8471
Malware in sbrugna...
CVE-2025-59398
The OCPP implementation in libocpp before 0.26.2 allows a denial of service EVerest crash via JSON input larger than 255 characters, because a CiString object is created with StringTooLarge set to Throw...
CVE-2025-25271
An unauthenticated adjacent attacker is able to configure a new OCPP backend, due to insecure defaults for the configuration interface...
PHOENIX CONTACT CHARX SEC 安全漏洞
PHOENIX CONTACT CHARX SEC is a series of AC charging controllers from PHOENIX CONTACT, Germany. A security vulnerability exists in the PHOENIX CONTACT CHARX SEC that originates from an unauthenticated neighboring attacker being able to configure a new OCPP backend due to the configuration interfa...
CVE-2023-49956
An issue was discovered in Dalmann OCPP.Core before 1.3.0 for OCPP Open Charge Point Protocol for electric vehicles. A StopTransaction message with any random transactionId terminates active transactions...
The vulnerability of the OCPP software-based modular controller systems for variable current charging stations and wall-mounted charging devices from Phoenix Contact CHARX SEC-3100 allows a perpetrator to gain unauthorized access and execute arbitrary codes.
The vulnerability of the OCPP microprogramming software for modular charge controllers for AC charging stations and wall-mounted charging devices from Phoenix Contact, CHARX SEC-3100, exists due to insufficient verification of input data. Exploiting this vulnerability can allow attackers to enhan...
PT-2024-18962 · Steve · Steve
Name of the Vulnerable Software and Affected Versions: SteVe affected versions not specified Description: SteVe is an open platform that implements different versions of the OCPP protocol for Electric Vehicle charge points, acting as a central server for management of registered charge points...
PT-2024-20210 · Chargepoint · Chargepoint Home Flex
Name of the Vulnerable Software and Affected Versions: ChargePoint Home Flex affected versions not specified Description: This issue allows network-adjacent attackers to execute arbitrary code on affected installations. The flaw exists within the handling of OCPP messages due to the lack of prope...
PT-2024-22286 · Phoenix Contact · Charx Sec-3100
Name of the Vulnerable Software and Affected Versions: Phoenix Contact CHARX SEC-3100 affected versions not specified Description: A local attacker with low privileges can exploit a command injection vulnerability to gain root privileges due to improper input validation using the OCPP Remote...