CVE-2026-20781 - Vulnerability Analysis

Overview

OCPP WebSocket endpoints contain a broken access control vulnerability caused by lack of authentication, letting unauthenticated attackers impersonate stations and manipulate backend data, exploit requires no authentication.

Severity & Score

Impact

Unauthenticated attackers can control charging stations, escalate privileges, and corrupt backend charging network data.

Mitigation

Implement proper authentication mechanisms on WebSocket endpoints or update to a version that enforces authentication.

References

• https://cloudcharge.tech/support/contact/
• https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-057-03.json
• https://www.cisa.gov/news-events/ics-advisories/icsa-26-057-03

Social Media Activity(1 post)

TheHackerWire

@thehackerwire

Feb 27, 2026

🔴 CVE-2026-20781 - Critical (9.4) WebSocket endpoints lack proper authentication mechanisms, enabling attackers to perform unauthorized station impersonation and manipulate data sent to the backend. An unauthenticated attacker can connect to the OCPP WebSocket endpoint using a ... 🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-20781/ #CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

View original post

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner