The vulnerability arises from missing authentication on WebSocket endpoints used by the EV Energy ev.energy platform. An attacker who can reach the OCPP WebSocket can connect using a known or guessed charging station identifier and issue or receive commands as if it were a legitimate charger. This flaw enables unauthorized control of charging infrastructure, potential privilege escalation, and corruption of data reported to the backend. The weakness is classified as CWE‑306 and leads to severe integrity, availability, and potentially confidentiality impacts.

The affected system is the EV Energy ev.energy product. No version information is supplied, which implies that all current releases are vulnerable until an official fix is released. The platform exposes OCPP WebSocket endpoints over the network, allowing attackers to target any station identifier known to an attacker.

The CVSS score of 9.3 indicates critical severity. The EPSS score is below 1 % and the issue is not yet in the CISA KEV catalog, suggesting low current exploitation probability, but the attack vector is straightforward: any network actor able to reach the WebSocket endpoint can exploit the flaw with only knowledge of a station identifier. Because authentication is absent, an attacker can impersonate a charger and modify commands, leading to unauthorized control of the charging process and data integrity compromise.