Authentication Flaw in OCPP WebSocket Endpoints Exposes Charging Stations by Epower

CVE-2026-22552

What is CVE-2026-22552?

The OCPP WebSocket endpoints provided by Epower are susceptible to an authentication bypass vulnerability that allows unauthorized attackers to impersonate legitimate charging stations. By exploiting this flaw, an intruder can connect to the WebSocket endpoint using a recognizable charging station ID and send or receive Open Charge Point Protocol (OCPP) commands without any authentication required. This exploitation can result in unauthorized control over charging infrastructure, leading to potential privilege escalation and manipulation of vital network data communicated to backend systems.

References