CVE-2026-27028 - Vulnerability Analysis
CriticalCVSS: 9.4Last Updated: March 2, 2026
OCPP WebSocket - Authentication Bypass
Overview
OCPP WebSocket endpoints contain an authentication bypass caused by lack of proper authentication mechanisms, letting unauthenticated attackers impersonate stations and manipulate backend data, exploit requires no authentication.
Severity & Score
Impact
Unauthenticated attackers can control charging infrastructure, escalate privileges, and corrupt backend data, risking operational disruption and data integrity.
Mitigation
Implement proper authentication mechanisms on WebSocket endpoints to prevent unauthorized access.
References
Social Media Activity(2 posts)
Critical Authentication and Session Flaws Discovered in Mobility46 EV Charging Stations Mobility46's EV charging platform contains four vulnerabilities, including a critical authentication bypass (CVE-2026-27028), that allow attackers to impersonate charging stations and seize administrative control. The vendor has not responded with a patch. **If you operate Mobility46 charging stations, make sure that the systems are isolated from the internet and accessible only from trusted networks or VPN.** #cybersecurity #infosec #advisory #vulnerability https://beyondmachines.net/event_details/critical-authentication-and-session-flaws-discovered-in-mobility46-ev-charging-stations-h-c-g-0-l/gD2P6Ple2L
View original post
š“ CVE-2026-27028 - Critical (9.4) WebSocket endpoints lack proper authentication mechanisms, enabling attackers to perform unauthorized station impersonation and manipulate data sent to the backend. An unauthenticated attacker can connect to the OCPP WebSocket endpoint using a ... š https://www.thehackerwire.com/vulnerability/CVE-2026-27028/ #CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack
View original postRelated Resources
Details
- CVE ID
- CVE-2026-27028
- Severity
- Critical
- CVSS Score
- 9.4
- Type
- broken_authentication
- Status
- confirmed
- EPSS
- 17.7%
- Social Posts
- 2
CWE
- CWE-306
CVSS Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L