CVE-2026-27767 SWITCH EV CVE debrief

Who should care

Operators and administrators of SWTCH EV charging deployments, EV charging network operators, site owners, and defenders responsible for OCPP backend integrations, charger onboarding, and network access controls.

Technical summary

The issue is an authentication weakness on WebSocket-based OCPP endpoints. Per the advisory, the attacker does not need valid credentials to establish a connection if they know or can discover a charging station identifier. That makes it possible to send or receive OCPP commands as if they were a legitimate charger, which can affect integrity of station identity, backend telemetry, and charging network control. The advisory’s remediation notes indicate SWTCH has applied configuration changes for initial connections from untrusted chargers, with additional enforcement for new connections and compensating controls such as monitoring and IP-based restrictions; some existing chargers may remain constrained by legacy firmware or SSL/TLS compatibility issues.

Defensive priority

Critical. Treat as high-priority exposure for any environment using affected SWTCH EV deployments, especially where chargers can reach the OCPP WebSocket endpoint over untrusted networks or where device identity is not strongly enforced.

Recommended defensive actions

• Review affected SWTCH EV deployments and confirm whether chargers are covered by the updated security policy described in the CISA advisory.
• Enforce authentication and connection-control checks on initial and subsequent OCPP WebSocket connections wherever technically supported.
• Apply IP-based access controls or other network-level restrictions to limit who can reach the charging backend and OCPP endpoints.
• Prioritize upgrades, reconfiguration, or retirement of chargers that cannot fully comply because of legacy firmware or SSL/TLS compatibility limits.
• Monitor connection attempts and charger traffic for anomalous station identifiers, unexpected sessions, or backend data inconsistencies.
• Consult the SWTCH Security portal and contact SWTCH support for device-specific remediation guidance.

Evidence notes

This debrief is based only on the CISA CSAF advisory ICSA-26-057-06 for CVE-2026-27767, published 2026-02-26 and updated 2026-05-14, plus the linked official CVE and CISA reference pages. The advisory explicitly states the authentication weakness, attack path, and mitigation notes. No exploit code or unsupported claims are included.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.