CVE-2026-27767 - Vulnerability Analysis
CriticalCVSS: 9.4Last Updated: March 2, 2026
OCPP WebSocket - Broken Access Control
Overview
OCPP WebSocket endpoints contain a broken access control vulnerability caused by lack of authentication, letting unauthenticated attackers impersonate stations and manipulate backend data, exploit requires no authentication.
Severity & Score
Impact
Unauthenticated attackers can control charging stations, escalate privileges, and corrupt backend charging network data.
Mitigation
Implement proper authentication mechanisms on WebSocket endpoints or update to a version that enforces authentication.
References
Social Media Activity(2 posts)
Critical Vulnerabilities in SWITCH EV Charging Platform Allow Station Impersonation SWITCH EV's charging platform contains four vulnerabilities, including a critical authentication bypass (CVE-2026-27767), that allow attackers to impersonate charging stations and hijack sessions. **Make sure your SWITCH EV station management is isolated from the internet and behind a firewall or VPN. Since the vendor has not released a patch that's your only defense until the vendor does something or you replace these systems.** #cybersecurity #infosec #advisory #vulnerability https://beyondmachines.net/event_details/critical-vulnerabilities-in-switch-ev-charging-platform-allow-station-impersonation-e-g-h-5-x/gD2P6Ple2L
View original post
š“ CVE-2026-27767 - Critical (9.4) WebSocket endpoints lack proper authentication mechanisms, enabling attackers to perform unauthorized station impersonation and manipulate data sent to the backend. An unauthenticated attacker can connect to the OCPP WebSocket endpoint using a ... š https://www.thehackerwire.com/vulnerability/CVE-2026-27767/ #CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack
View original postRelated Resources
Details
- CVE ID
- CVE-2026-27767
- Severity
- Critical
- CVSS Score
- 9.4
- Type
- broken_access_control
- Status
- confirmed
- EPSS
- 13.2%
- Social Posts
- 2
CWE
- CWE-306
CVSS Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L