CVE-2026-29796 IGL-Technologies CVE debrief

Who should care

EV charging network operators, site administrators, OT/ICS security teams, SOC analysts monitoring charger backends, and organizations running IGL-Technologies eParking.fi OCPP deployments.

Technical summary

The advisory states that WebSocket endpoints lacked proper authentication controls. An attacker who knows or discovers a charging-station identifier can connect to the OCPP WebSocket endpoint without authentication and then issue or receive OCPP commands as though they were a legitimate charger. The reported impact is unauthorized station impersonation, backend data integrity loss, and control-plane abuse of charging infrastructure. CISA’s remediation notes also state that updated OCPP servers added stronger authentication, device-level whitelisting, rate limiting, and enhanced monitoring.

Defensive priority

High / critical priority. The issue is network-reachable, requires no authentication, and affects control and integrity of charging infrastructure. Prioritize any exposed OCPP WebSocket deployments first, especially where station identifiers may be known or enumerable.

Recommended defensive actions

• Apply the vendor-provided eParking.fi OCPP server updates and verify the strengthened authentication controls are enabled.
• Implement device-level whitelisting so only authorized charging units can connect to the OCPP service.
• Restrict network exposure of OCPP WebSocket endpoints to trusted management and charger networks only.
• Enable rate limiting and alerting for abnormal connection attempts or command patterns.
• Review backend logs for unexpected station identifiers, unusual charger impersonation, or malformed OCPP activity.
• Confirm whether your deployment uses the encrypted eParking OCPP server or IGL-Technologies' proprietary eTolppa protocol; the advisory states those are not impacted.
• Contact IGL-Technologies security via [email protected] if you need product-specific remediation guidance.

Evidence notes

The supplied CISA CSAF advisory for ICSA-26-078-07 / CVE-2026-29796 states that WebSocket endpoints lacked proper authentication, enabling unauthorized station impersonation and backend manipulation. It further states that an unauthenticated attacker can connect using a known or discovered charging-station identifier and issue or receive OCPP commands as a legitimate charger. The advisory was initially published on 2026-03-19 and includes a remediation section describing stronger authentication, device-level whitelisting, rate limiting, and monitoring. No KEV listing or exploit reporting was supplied in the source corpus.

Official resources