WebSocket endpoints in CloudCharge’s cloudcharge.se platform lack authentication, allowing attackers to impersonate charging stations or consume data. This flaw enables an unauthenticated user to connect to the OCPP WebSocket, issue or receive commands as a legitimate charger, and consequently raise privileges or alter backend data. The result is direct compromise of charging infrastructure operations and integrity of the network’s reported information.

The vulnerability affects the CloudCharge cloudcharge.se application, specifically its WebSocket interface used by charging stations. No specific version details are provided, but all deployments of the integrated OCPP endpoint are impacted.

The flaw carries a CVSS score of 9.3, indicating critical severity. The EPSS score is below 1%, suggesting that real-world exploitation is unlikely at present, though the CVE is not listed in CISA’s KEV catalog. Attackers can exploit the weakness by simply establishing a WebSocket connection with a known or discovered station identifier, a process that requires no credentials. Because authentication is absent, the attack vector is straightforward and does not require additional preconditions beyond network connectivity to the OCPP endpoint.