CVE-2026-25192 - Vulnerability Analysis
CriticalCVSS: 9.4Last Updated: March 20, 2026
OCPP WebSocket - Broken Access Control
Overview
OCPP WebSocket endpoints contain a broken access control vulnerability caused by lack of authentication, letting unauthenticated attackers impersonate charging stations and manipulate backend data, exploit requires no authentication.
Severity & Score
Impact
Unauthenticated attackers can control charging infrastructure and corrupt network data, leading to privilege escalation and unauthorized operations.
Mitigation
Implement proper authentication mechanisms on WebSocket endpoints or update to a version with authentication enforced.
References
Social Media Activity(2 posts)
CTEK Chargeportal Vulnerabilities Enable Unauthorized Control of EV Infrastructure CISA reports four vulnerabilities in the Chargeportal platform by CTEK, including a critical authentication bypass (CVE-2026-25192), that allow attackers to impersonate charging stations and gain unauthorized control. The product is scheduled for sunset in April 2026, leaving network isolation as the primary defense for current users. **Since CTEK is sunsetting Chargeportal without a patch, make sure you isolate the systems as much as possible from public access and the public internet. Then planning a migration to a supported charging management platform.** #cybersecurity #infosec #advisory #vulnerability https://beyondmachines.net/event_details/ctek-chargeportal-vulnerabilities-enable-unauthorized-control-of-ev-infrastructure-q-m-c-l-x/gD2P6Ple2L
View original post
CTEK Chargeportal Vulnerabilities Enable Unauthorized Control of EV Infrastructure CISA reports four vulnerabilities in the Chargeportal platform by CTEK, including a critical authentication bypass (CVE-2026-25192), that allow attackers to impersonate charging stations and gain unauthorized control. The product is scheduled for sunset in April 2026, leaving network isolation as the primary defense for current users. **Since CTEK is sunsetting Chargeportal without a patch, make sure you isolate the systems as much as possible from public access and the public internet. Then planning a migration to a supported charging management platform.** #cybersecurity #infosec #advisory #vulnerability https://beyondmachines.net/event_details/ctek-chargeportal-vulnerabilities-enable-unauthorized-control-of-ev-infrastructure-q-m-c-l-x/gD2P6Ple2L
View original postRelated Resources
Details
- CVE ID
- CVE-2026-25192
- Severity
- Critical
- CVSS Score
- 9.4
- Type
- broken_access_control
- Status
- new
- EPSS
- 0.0%
- Social Posts
- 2
CWE
- CWE-306
CVSS Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L