321 matches found
Mobiliti code issue vulnerabilities
Mobiliti is an electric vehicle charging station system developed by the Hungarian company Mobiliti. Mobiliti has a code vulnerability that arises from using charging station identifiers to associate sessions, but allowing multiple endpoints to use the same session identifier for connection. This...
ePower security vulnerabilities
ePower is a electric vehicle charging station system owned by the Irish company ePower. ePower has a security vulnerability, as the identity identifiers of charging stations can be accessed publicly through a web-based mapping platform...
PT-2026-23720
Name of the Vulnerable Software and Affected Versions Charging station affected versions not specified Description Charging station authentication identifiers are publicly accessible through web-based mapping platforms. This exposure potentially allows unauthorized access or misuse of charging...
CVE-2026-24912 ePower epower.ie Insufficient Session Expiration
The WebSocket backend uses charging station identifiers to uniquely associate sessions but allows multiple endpoints to connect using the same session identifier. This implementation results in predictable session identifiers and enables session hijacking or shadowing, where the most recent...
ePower epower.ie
RISK EVALUATION Successful exploitation of these vulnerabilities could enable attackers to gain unauthorized administrative control over vulnerable charging stations or disrupt charging services through denial-of-service attacks. 2. RECOMMENDED PRACTICES CISA recommends users take defensive...
Everon OCPP Backends
RISK EVALUATION Successful exploitation of these vulnerabilities could enable attackers to gain unauthorized administrative control over vulnerable charging stations or disrupt charging services through denial-of-service attacks. 2. RECOMMENDED PRACTICES CISA recommends users take defensive...
CVE-2026-25774
Charging station authentication identifiers are publicly accessible via web-based mapping platforms...
CVE-2026-20791
Charging station authentication identifiers are publicly accessible via web-based mapping platforms...
CVE-2026-22890
Charging station authentication identifiers are publicly accessible via web-based mapping platforms...
CVE-2026-22878
Charging station authentication identifiers are publicly accessible via web-based mapping platforms...
CVE-2026-25851
WebSocket endpoints lack proper authentication mechanisms, enabling attackers to perform unauthorized station impersonation and manipulate data sent to the backend. An unauthenticated attacker can connect to the OCPP WebSocket endpoint using a known or discovered charging station identifier, then...
CVE-2026-27772
WebSocket endpoints lack proper authentication mechanisms, enabling attackers to perform unauthorized station impersonation and manipulate data sent to the backend. An unauthenticated attacker can connect to the OCPP WebSocket endpoint using a known or discovered charging station identifier, then...
EUVD-2026-8961
The WebSocket backend uses charging station identifiers to uniquely associate sessions but allows multiple endpoints to connect using the same session identifier. This implementation results in predictable session identifiers and enables session hijacking or shadowing, where the most recent...
CVE-2026-22878
Charging station authentication identifiers are publicly accessible via web-based mapping platforms...
EUVD-2026-8928
Charging station authentication identifiers are publicly accessible via web-based mapping platforms...
CVE-2026-27647 Mobility46 mobility46.se Insufficient Session Expiration
The WebSocket backend uses charging station identifiers to uniquely associate sessions but allows multiple endpoints to connect using the same session identifier. This implementation results in predictable session identifiers and enables session hijacking or shadowing, where the most recent...
CVE-2026-27028
CVE-2026-27028 affects WebSocket endpoints used by OCPP implementations. The issue is lack of authentication, allowing unauthenticated attackers to connect with a charging station identifier and impersonate a charger, issue or receive OCPP commands, and potentially escalate privileges, take unaut...
CVE-2026-25774 EV Energy ev.energy Insufficiently Protected Credentials
Charging station authentication identifiers are publicly accessible via web-based mapping platforms...