Mohammad Ali Sayed

**Name of the Vulnerable Software and Affected Versions** CTEK Chargeport (affected versions not specified) **Description** WebSocket endpoints lack proper authentication mechanisms, enabling attackers to perform unauthorized station impersonation and manipulate data sent to the backend. An unauthenticated attacker can connect to the OCPP WebSocket endpoint using a known or discovered charging station identifier, then issue or receive OCPP commands as a legitimate charger. This can lead to privilege escalation, unauthorized control of charging infrastructure, and corruption of charging network data reported to the backend. The issue allows attackers to perform unauthorized station impersonation and manipulate data sent to the backend via the OCPP WebSocket endpoint. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** WebSocket Application Programming Interface (affected versions not specified) **Description** The WebSocket Application Programming Interface does not restrict the number of authentication requests. This lack of rate limiting could enable an attacker to perform denial-of-service attacks by disrupting or misdirecting legitimate charger telemetry. It may also allow brute-force attacks to gain unauthorized access. The API lacks rate limiting on authentication requests, potentially impacting a large number of devices. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Charging station (affected versions not specified) **Description** Charging station authentication identifiers are publicly accessible through web-based mapping platforms. This exposure potentially allows unauthorized access or misuse of charging station services. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Charging Station Backend (affected versions not specified) **Description** The WebSocket backend uses charging station identifiers to associate sessions, but allows multiple endpoints to connect using the same session identifier. This results in predictable session identifiers, enabling session hijacking or shadowing. A recent connection can displace a legitimate charging station and receive backend commands intended for that station. This may allow unauthorized authentication or a denial-of-service condition by overwhelming the backend with valid session requests. The vulnerability involves the use of the same session identifier for multiple endpoints, potentially allowing a malicious actor to intercept and manipulate communication with charging stations. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Nome do Software Vulnerável e Versões Afetadas** Interface de Programação de Aplicação WebSocket (versões afetadas não especificadas) **Descrição** A Interface de Programação de Aplicação WebSocket não restringe o número de solicitações de autenticação. Essa falta de limitação de taxa pode permitir que atacantes realizem ataques de negação de serviço, interrompendo ou desviando a telemetria legítima do carregador. Também pode permitir ataques de força bruta para obter acesso não autorizado. **Recomendações** No momento, não há informações sobre uma versão mais recente que contenha uma correção para esta vulnerabilidade.

**Name of the Vulnerable Software and Affected Versions** ePower epower.ie (affected versions not specified) **Description** Charging station authentication identifiers are publicly accessible through web-based mapping platforms. This exposure potentially allows unauthorized access to charging stations. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Nome do Software Vulnerável e Versões Afetadas** Versões (versões afetadas não especificadas) **Descrição** O backend WebSocket utiliza identificadores de estação de carregamento para associar sessões de forma única, mas permite que múltiplos endpoints se conectem utilizando o mesmo identificador de sessão. Isso resulta em identificadores de sessão previsíveis, permitindo o sequestro de sessão (session hijacking) ou sombreamento (shadowing), onde uma conexão recente pode deslocar uma estação de carregamento legítima e receber comandos de backend destinados a ela. Isso pode permitir autenticação de usuário não autorizada ou uma condição de negação de serviço, sobrecarregando o backend com solicitações de sessão válidas. **Recomendações** No momento, não há informações sobre uma versão mais recente que contenha uma correção para esta vulnerabilidade.

**Nome do Software Vulnerável e Versões Afetadas** (versões afetadas não especificadas) **Descrição** Os endpoints WebSocket estão sem a autenticação adequada, permitindo que atacantes se passem por estações de carregamento e manipulem dados do backend. Um atacante não autenticado pode conectar-se ao endpoint WebSocket OCPP usando um identificador de estação de carregamento conhecido ou descoberto e, em seguida, enviar ou receber comandos OCPP como um carregador legítimo. Isso pode levar ao escalonamento de privilégios, controle não autorizado da infraestrutura de carregamento e corrupção de dados da rede de carregamento. O problema permite que atacantes realizem a personificação não autorizada da estação e manipulem dados enviados ao backend através do ''endpoint WebSocket OCPP''. **Recomendações** No momento, não há informações sobre uma versão mais recente que contenha uma correção para esta vulnerabilidade.

**Name of the Vulnerable Software and Affected Versions** Charging station (affected versions not specified) **Description** Authentication identifiers for charging stations are publicly accessible through web-based mapping platforms. This exposure allows unauthorized access to potentially sensitive information related to the charging infrastructure. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** WebSocket backend (affected versions not specified) **Description** The backend utilizes charging station identifiers to uniquely associate sessions but permits multiple endpoints to connect using the same session identifier. This results in predictable session identifiers, enabling session hijacking or shadowing where a newer connection replaces a legitimate charging station and receives intended backend commands. This may allow unauthorized authentication or a denial-of-service condition by overwhelming the backend with session requests. The vulnerability impacts the association of sessions via charging station identifiers and the handling of multiple connections with the same session identifier. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Systems utilizing WebSocket endpoints for the Open Charge Point Protocol (OCPP) (affected versions not specified) **Description** WebSocket endpoints lack proper authentication mechanisms, allowing unauthenticated attackers to connect and impersonate legitimate charging stations. This enables attackers to issue or receive OCPP commands, potentially leading to privilege escalation, unauthorized control of charging infrastructure, and corruption of charging network data reported to the backend. An attacker can connect to the OCPP WebSocket endpoint using a known or discovered charging station identifier. The vulnerability allows manipulation of data sent to the backend. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Charging station software (affected versions not specified) **Description** Authentication identifiers for charging stations are publicly accessible through web-based mapping platforms. This exposure potentially allows unauthorized access or manipulation of charging station services. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** WebSocket Application Programming Interface (affected versions not specified) **Description** The WebSocket Application Programming Interface does not limit the number of authentication requests. This lack of rate limiting could enable an attacker to perform denial-of-service attacks by suppressing or misrouting legitimate charger telemetry, or to conduct brute-force attacks to gain unauthorized access. The API endpoint is susceptible to abuse due to the absence of restrictions on authentication attempts. An attacker could exploit this by sending a high volume of requests to the `/websocket` endpoint, potentially overwhelming the system and disrupting legitimate services. The vulnerable parameter is the authentication request itself. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Charging station (affected versions not specified) **Description** Authentication identifiers for charging stations are publicly accessible through web-based mapping platforms. This exposure allows unauthorized access to potentially sensitive information related to the charging infrastructure. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Charging station software (affected versions not specified) **Description** The WebSocket backend associates sessions using charging station identifiers, but allows multiple endpoints to connect with the same session identifier. This results in predictable session identifiers, enabling session hijacking or shadowing. A recent connection can displace a legitimate charging station and receive backend commands intended for it. This could allow unauthorized authentication or a denial-of-service condition by overwhelming the backend with valid session requests. The vulnerable component uses `session identifier` to associate WebSocket sessions. The API endpoint is susceptible to session hijacking. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** WebSocket Application Programming Interface (affected versions not specified) **Description** The WebSocket Application Programming Interface does not limit the number of authentication requests. This lack of rate limiting could enable an attacker to perform denial-of-service attacks by suppressing or misrouting legitimate charger telemetry. It may also allow attackers to conduct brute-force attacks to gain unauthorized access. The API endpoints are susceptible to abuse due to the absence of request restrictions. The `authentication` process is vulnerable to brute-force attempts. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Systems utilizing WebSocket endpoints for the Open Charge Point Protocol (OCPP) (affected versions not specified) **Description** WebSocket endpoints lack proper authentication mechanisms, allowing attackers to perform unauthorized station impersonation and manipulate data sent to the backend. An unauthenticated attacker can connect to the OCPP WebSocket endpoint using a known or discovered charging station identifier, then issue or receive OCPP commands as a legitimate charger. This can lead to privilege escalation, unauthorized control of charging infrastructure, and corruption of charging network data reported to the backend. The issue involves the absence of proper authentication on WebSocket interfaces, enabling malicious commands and data manipulation. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Charging station software (affected versions not specified) **Description** The WebSocket backend associates sessions using charging station identifiers, but allows multiple endpoints to connect with the same session identifier. This results in predictable session identifiers, enabling session hijacking or shadowing. The latest connection replaces the legitimate charging station, receiving backend commands intended for it. This could allow unauthorized authentication or a denial-of-service condition by overwhelming the backend with valid session requests. The vulnerable component uses charging station identifiers to uniquely associate sessions. The API endpoint is susceptible to session hijacking due to predictable session identifiers. The `session identifier` variable is vulnerable to manipulation. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** EV2GO (affected versions not specified) **Description** The software’s WebSocket endpoints do not have sufficient authentication, allowing attackers to impersonate charging stations without authorization and manipulate data transmitted to the backend. An unauthenticated attacker can connect to the OCPP WebSocket endpoint using a known or discovered charging station identifier and then send or receive OCPP commands as a legitimate charger. This can result in privilege escalation, unauthorized control of charging infrastructure, and corruption of charging network data reported to the backend. The affected API endpoint is the OCPP WebSocket endpoint. The vulnerable parameter is the charging station identifier. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Systems utilizing WebSocket endpoints for Open Charge Point Protocol (OCPP) communication (affected versions not specified) **Description** WebSocket endpoints are missing appropriate authentication, allowing attackers to impersonate charging stations and manipulate data sent to the backend. An unauthenticated attacker can connect to the OCPP WebSocket endpoint using a known or discovered charging station identifier and then issue or receive OCPP commands as a legitimate charger. This can lead to privilege escalation, unauthorized control of charging infrastructure, and corruption of charging network data. The affected API endpoint is the OCPP WebSocket endpoint. The vulnerable parameter is the charging station identifier. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.