The vulnerability is found in ePower's epower.ie WebSocket endpoints, which lack authentication for critical OCPP functions. An attacker can connect to the backend using only a valid or guessed charging station identifier and then issue or intercept OCPP commands as if they were the legitimate charger. This can result in unauthorized control of the charging station, tampering with charging data, and potentially disrupting the charging network.

The weakness affects ePower:epower.ie devices. No specific firmware or software version is listed on the CNA, so any installation of ePower's epower.ie that includes the vulnerable WebSocket interfaces is susceptible. Organizations should inventory all ePower epower.ie units and verify the presence of this flaw.

The CVSS score of 9.3 places the issue in the high-impact range. The EPSS score of <1% indicates that active exploitation is currently unlikely, but the lack of authentication renders the impact severe if the attacker can connect to the endpoint. The vulnerability has not yet been listed in the CISA KEV catalog. Attackers would typically target the OCPP WebSocket endpoint over the public or internal network, requiring only the station identifier and network connectivity. No external code execution or elevated privileges outside the charging domain are required, but the ability to issue control commands can lead to significant operational harm.