CVE-2026-24731 Unknown Vendor CVE debrief

Who should care

EV charging network operators, station fleet administrators, OT/security teams, backend platform owners, and integrators that expose or broker OCPP/WebSocket access for EV2GO deployments.

Technical summary

The core issue is missing authentication on WebSocket endpoints used for OCPP communications. According to the CISA CSAF, an attacker does not need credentials to connect, and can then issue or receive OCPP commands as if they were a legitimate charging station. Because station identity can be inferred or discovered, the attack can affect backend trust decisions and data integrity across the charging network. The supplied CVSS vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L.

Defensive priority

Urgent. This is a network-reachable authentication failure with direct impact on integrity and control of charging infrastructure, so it should be treated as a high-priority exposure for any affected deployment.

Recommended defensive actions

• Restrict exposure of the OCPP/WebSocket service to trusted networks and management paths only.
• Add strong authentication and per-station authorization before any WebSocket or OCPP session is established.
• Review backend logic that accepts station identity and commands; reject unauthenticated or inconsistent session metadata.
• Audit logs for unusual station identifiers, repeated connection attempts, or unexpected command/response patterns.
• Check all EV2GO-connected charging assets for backend data inconsistencies or unexplained control actions.
• Contact EV2GO for remediation guidance and monitor CISA/CVE updates for any vendor response or fix information.
• Apply network segmentation and access control around charging infrastructure while remediation is pending.

Evidence notes

All core facts are drawn from the supplied CISA CSAF advisory for ICSA-26-057-04 / CVE-2026-24731, published 2026-02-26. The advisory states that WebSocket endpoints lack proper authentication, that an unauthenticated attacker can use a known or discovered charging-station identifier to impersonate a charger and send/receive OCPP commands, and that this can cause privilege escalation, unauthorized control, and corruption of backend-reported data. The source also notes EV2GO did not respond to CISA’s coordination request. Vendor/product attribution in the source corpus is marked low confidence and needs review.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.