CVE-2026-27772 is a critical authentication bypass vulnerability affecting ev.energy's charging platform. It allows unauthenticated attackers to connect to OCPP WebSocket endpoints using known or discovered charging station identifiers. This enables unauthorized station impersonation, manipulation of backend data, and control over charging infrastructure. With a CVSS score of 9.8 (Critical), the vulnerability is easily exploitable over the network with low attack complexity, leading to high impacts on confidentiality, integrity, and availability. While not currently listed in CISA KEV or having public exploit code (Metasploit, Nuclei, ExploitDB), it has garnered significant community discussion, indicating awareness and potential for future exploitation.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
All Versions ImpactedCPE matchmatch criteria | cpe:2.3:a:ev.energy:ev.energy:*:*:*:*:*:*:*:* |
CVSS version used by this source: 4.0
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.3 Bluesky, 0.3 Mastodon, and 2.4 GitHub mentions.
The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Remediation records are not available for this CVE.