CVE-2026-22552 Details

A vulnerability exists in the WebSocket endpoints of ePower's charging station management system, all versions, due to a lack of proper authentication. This flaw allows attackers to impersonate legitimate charging stations and manipulate data sent to the backend. An unauthenticated attacker can connect to the OCPP WebSocket endpoint using a known or discovered charging station identifier, and then issue or receive OCPP commands as if they were a legitimate charger. The absence of authentication could lead to unauthorized control over charging infrastructure, privilege escalation, and corruption of charging network data reported to the backend.

ePower did not respond to CISA's request for coordination. Contact ePower through their support page for more information.