View CSAF
Summary
Successful exploitation of these vulnerabilities could allow attackers to impersonate charging stations, hijack sessions, suppress or misroute legitimate traffic to cause large-scale denial of service, and manipulate data sent to the backend.
The following versions of EV2GO ev2go.io are affected:
ev2go.io vers:all/* (CVE-2026-24731, CVE-2026-25945, CVE-2026-20895, CVE-2026-22890)
CVSS
Vendor
Equipment
Vulnerabilities
v3 9.4
EV2GO
EV2GO ev2go.io
Missing Authentication for Critical Function, Improper Restriction of Excessive Authentication Attempts, Insufficient Session Expiration, Insufficiently Protected Credentials
Background
Critical Infrastructure Sectors: Energy, Transportation Systems
Countries/Areas Deployed: Worldwide
Company Headquarters Location: United Kingdom
Vulnerabilities
Expand All +
CVE-2026-24731
WebSocket endpoints lack proper authentication mechanisms, enabling attackers to perform unauthorized station impersonation and manipulate data sent to the backend. An unauthenticated attacker can connect to the OCPP WebSocket endpoint using a known or discovered charging station identifier, then issue or receive OCPP commands as a legitimate charger. Given that no authentication is required, this can lead to privilege escalation, unauthorized control of charging infrastructure, and corruption of charging network data reported to the backend.
View CVE De...