WebSocket endpoints used by Mobiliti e-mobi.hu lack proper authentication, allowing an attacker to connect to the OCPP endpoint using a known or discovered charging station identifier and issue or receive commands as a legitimate charger. This flaw is a missing authentication weakness (CWE-306) that can result in privilege escalation, manipulation of charging commands, and corruption of network data reported to the backend.

The vulnerability affects Mobiliti’s e-mobi.hu charging infrastructure. No specific version information is provided, so any deployment that uses the OCPP WebSocket interface of this product could be impacted.

With a CVSS score of 9.3 the flaw is considered critical. The EPSS score is less than 1%, suggesting low current exploitation likelihood, but the flaw remains high‑risk because it allows complete control of charging stations. The vulnerability is not listed in the CISA KEV catalog. Based on the description, the likely attack vector is a network attacker who can reach the charging station over the OCPP WebSocket port and authenticate no authentication is required, enabling impersonation and command injection.