This vulnerability stems from missing authentication on the OCPP WebSocket endpoints of the SWITCH EV software. An attacker can connect to the endpoint without credentials, impersonate charging stations, and issue or receive OCPP commands as if they were a legitimate charger. The resulting impact includes the ability to gain unauthorized control over charging infrastructure and to corrupt the data reported to the backend, potentially disrupting network integrity and availability.

The product affected is SWITCH EV’s swtchenergy.com software. All releases that expose the WebSocket OCPP interface without authentication are vulnerable; specific patch-level or version details are not publicly documented, so all current installations should be reviewed for missing authentication.

The CVSS score of 9.3 signals a high‑severity risk, though the EPSS score of less than 1 % indicates a low exploitation probability and the vulnerability has not been listed in the CISA KEV catalog. The likely attack vector is remote, leveraging the network to reach the WebSocket endpoint. An attacker who knows a charging station identifier can establish a session, send arbitrary OCPP commands, and thereby elevate privileges to that station level.