WebSocket endpoints in the EV2GO platform omit authentication, allowing an attacker to connect to the OCPP WebSocket using a known charging station identifier and issue or receive commands as if acting as a legitimate charger. This misconfiguration permits remote privilege escalation, unauthorized control of charging infrastructure, and corruption of charging network data reported to the backend.

The affected system is EV2GO’s ev2go.io platform. No version information was disclosed, so all deployments may be impacted.

The CVSS score of 9.3 indicates critical severity, while the EPSS probability is below 1%, implying limited current exploitation activity. The vulnerability is not listed in CISA’s KEV catalog, so no known exploitation campaigns have been reported. The attack vector is network-based, requiring only remote access to the WebSocket endpoint and knowledge of a charging station ID.