The vulnerability exists in the WebSocket endpoints of IGL‑Technologies eParking.fi’s OCPP servers. Without proper authentication, an unauthenticated attacker can connect to the exposed endpoint using a known charging station identifier. This allows the attacker to issue or intercept OCPP commands as if they were a legitimate charger, enabling them to manipulate charging data, alter state, or disrupt service. The consequence is privilege escalation against the charging network, potentially causing unauthorized control of infrastructure and corruption of data reported to the backend.

Affected products belong to IGL‑Technologies: the eParking.fi platform, specifically the OCPP servers that expose WebSocket endpoints. Versions before the vendor’s updated release, which added security controls, are impacted. Devices that deploy the encrypted eParking OCPP servers or use IGL’s proprietary eTolppa protocol are not affected, as the vulnerability targets only the plain OCPP WebSocket interface.

The CVSS score of 9.3 indicates a high severity vulnerability. No EPSS score is available, and the issue has not been listed in the CISA KEV catalog. Attackers can exploit this flaw remotely by simply opening a WebSocket connection to the server, requiring no credentials. Because the attack path is straightforward and the scope covers the entire charging network, the risk remains high. The vendor has released a patch that mitigates the issue, but until it is applied the vulnerability remains fully exploitable.