CVE-2026-24731

CVE-2026-24731 is a critical vulnerability affecting ev2go.io products, stemming from a lack of proper authentication on WebSocket endpoints. An unauthenticated attacker can impersonate legitimate charging stations, issue or receive OCPP commands, and manipulate data. This allows for unauthorized control of charging infrastructure, privilege escalation, and data corruption, with a CVSS score of 9.8 (Critical) indicating a network-based attack with low complexity and high impact on confidentiality, integrity, and availability. While there is no known active exploitation or public exploit code (Metasploit, Nuclei, ExploitDB), the vulnerability has garnered significant community discussion and media coverage, suggesting awareness among threat actors.