Khaled Sarieddine

**Name of the Vulnerable Software and Affected Versions** CTEK Chargeport (affected versions not specified) **Description** WebSocket endpoints lack proper authentication mechanisms, enabling attackers to perform unauthorized station impersonation and manipulate data sent to the backend. An unauthenticated attacker can connect to the OCPP WebSocket endpoint using a known or discovered charging station identifier, then issue or receive OCPP commands as a legitimate charger. This can lead to privilege escalation, unauthorized control of charging infrastructure, and corruption of charging network data reported to the backend. The issue allows attackers to perform unauthorized station impersonation and manipulate data sent to the backend via the OCPP WebSocket endpoint. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** WebSocket Application Programming Interface (affected versions not specified) **Description** The WebSocket Application Programming Interface does not restrict the number of authentication requests. This lack of rate limiting could enable an attacker to perform denial-of-service attacks by disrupting or misdirecting legitimate charger telemetry. It may also allow brute-force attacks to gain unauthorized access. The API lacks rate limiting on authentication requests, potentially impacting a large number of devices. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Charging station (affected versions not specified) **Description** Charging station authentication identifiers are publicly accessible through web-based mapping platforms. This exposure potentially allows unauthorized access or misuse of charging station services. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Charging Station Backend (affected versions not specified) **Description** The WebSocket backend uses charging station identifiers to associate sessions, but allows multiple endpoints to connect using the same session identifier. This results in predictable session identifiers, enabling session hijacking or shadowing. A recent connection can displace a legitimate charging station and receive backend commands intended for that station. This may allow unauthorized authentication or a denial-of-service condition by overwhelming the backend with valid session requests. The vulnerability involves the use of the same session identifier for multiple endpoints, potentially allowing a malicious actor to intercept and manipulate communication with charging stations. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** WebSocket Application Programming Interface (affected versions not specified) **Description** The WebSocket Application Programming Interface does not restrict the number of authentication requests. This lack of rate limiting could enable attackers to perform denial-of-service attacks by disrupting or misdirecting legitimate charger telemetry. It may also allow brute-force attacks to gain unauthorized access. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** ePower epower.ie (affected versions not specified) **Description** Charging station authentication identifiers are publicly accessible through web-based mapping platforms. This exposure potentially allows unauthorized access to charging stations. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Versions (affected versions not specified) **Description** The WebSocket backend uses charging station identifiers to uniquely associate sessions but allows multiple endpoints to connect using the same session identifier. This results in predictable session identifiers, enabling session hijacking or shadowing where a recent connection can displace a legitimate charging station and receive intended backend commands. This may allow unauthorized user authentication or a denial-of-service condition by overwhelming the backend with valid session requests. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** (affected versions not specified) **Description** WebSocket endpoints are missing appropriate authentication, allowing attackers to impersonate charging stations and manipulate backend data. An unauthenticated attacker can connect to the OCPP WebSocket endpoint using a known or discovered charging station identifier and then send or receive OCPP commands as a legitimate charger. This could lead to privilege escalation, unauthorized control of charging infrastructure, and corruption of charging network data. The issue allows attackers to perform unauthorized station impersonation and manipulate data sent to the backend via the ''OCPP WebSocket endpoint''. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Charging station (affected versions not specified) **Description** Authentication identifiers for charging stations are publicly accessible through web-based mapping platforms. This exposure allows unauthorized access to potentially sensitive information related to the charging infrastructure. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** WebSocket backend (affected versions not specified) **Description** The backend utilizes charging station identifiers to uniquely associate sessions but permits multiple endpoints to connect using the same session identifier. This results in predictable session identifiers, enabling session hijacking or shadowing where a newer connection replaces a legitimate charging station and receives intended backend commands. This may allow unauthorized authentication or a denial-of-service condition by overwhelming the backend with session requests. The vulnerability impacts the association of sessions via charging station identifiers and the handling of multiple connections with the same session identifier. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Systems utilizing WebSocket endpoints for the Open Charge Point Protocol (OCPP) (affected versions not specified) **Description** WebSocket endpoints lack proper authentication mechanisms, allowing unauthenticated attackers to connect and impersonate legitimate charging stations. This enables attackers to issue or receive OCPP commands, potentially leading to privilege escalation, unauthorized control of charging infrastructure, and corruption of charging network data reported to the backend. An attacker can connect to the OCPP WebSocket endpoint using a known or discovered charging station identifier. The vulnerability allows manipulation of data sent to the backend. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Charging station software (affected versions not specified) **Description** Authentication identifiers for charging stations are publicly accessible through web-based mapping platforms. This exposure potentially allows unauthorized access or manipulation of charging station services. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** WebSocket Application Programming Interface (affected versions not specified) **Description** The WebSocket Application Programming Interface does not limit the number of authentication requests. This lack of rate limiting could enable an attacker to perform denial-of-service attacks by suppressing or misrouting legitimate charger telemetry, or to conduct brute-force attacks to gain unauthorized access. The API endpoint is susceptible to abuse due to the absence of restrictions on authentication attempts. An attacker could exploit this by sending a high volume of requests to the `/websocket` endpoint, potentially overwhelming the system and disrupting legitimate services. The vulnerable parameter is the authentication request itself. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Charging station (affected versions not specified) **Description** Authentication identifiers for charging stations are publicly accessible through web-based mapping platforms. This exposure allows unauthorized access to potentially sensitive information related to the charging infrastructure. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Charging station software (affected versions not specified) **Description** The WebSocket backend associates sessions using charging station identifiers, but allows multiple endpoints to connect with the same session identifier. This results in predictable session identifiers, enabling session hijacking or shadowing. A recent connection can displace a legitimate charging station and receive backend commands intended for it. This could allow unauthorized authentication or a denial-of-service condition by overwhelming the backend with valid session requests. The vulnerable component uses `session identifier` to associate WebSocket sessions. The API endpoint is susceptible to session hijacking. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** WebSocket Application Programming Interface (affected versions not specified) **Description** The WebSocket Application Programming Interface does not limit the number of authentication requests. This lack of rate limiting could enable an attacker to perform denial-of-service attacks by suppressing or misrouting legitimate charger telemetry. It may also allow attackers to conduct brute-force attacks to gain unauthorized access. The API endpoints are susceptible to abuse due to the absence of request restrictions. The `authentication` process is vulnerable to brute-force attempts. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Systems utilizing WebSocket endpoints for the Open Charge Point Protocol (OCPP) (affected versions not specified) **Description** WebSocket endpoints lack proper authentication mechanisms, allowing attackers to perform unauthorized station impersonation and manipulate data sent to the backend. An unauthenticated attacker can connect to the OCPP WebSocket endpoint using a known or discovered charging station identifier, then issue or receive OCPP commands as a legitimate charger. This can lead to privilege escalation, unauthorized control of charging infrastructure, and corruption of charging network data reported to the backend. The issue involves the absence of proper authentication on WebSocket interfaces, enabling malicious commands and data manipulation. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Charging station software (affected versions not specified) **Description** The WebSocket backend associates sessions using charging station identifiers, but allows multiple endpoints to connect with the same session identifier. This results in predictable session identifiers, enabling session hijacking or shadowing. The latest connection replaces the legitimate charging station, receiving backend commands intended for it. This could allow unauthorized authentication or a denial-of-service condition by overwhelming the backend with valid session requests. The vulnerable component uses charging station identifiers to uniquely associate sessions. The API endpoint is susceptible to session hijacking due to predictable session identifiers. The `session identifier` variable is vulnerable to manipulation. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** EV2GO (affected versions not specified) **Description** The software’s WebSocket endpoints do not have sufficient authentication, allowing attackers to impersonate charging stations without authorization and manipulate data transmitted to the backend. An unauthenticated attacker can connect to the OCPP WebSocket endpoint using a known or discovered charging station identifier and then send or receive OCPP commands as a legitimate charger. This can result in privilege escalation, unauthorized control of charging infrastructure, and corruption of charging network data reported to the backend. The affected API endpoint is the OCPP WebSocket endpoint. The vulnerable parameter is the charging station identifier. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Systems utilizing WebSocket endpoints for Open Charge Point Protocol (OCPP) communication (affected versions not specified) **Description** WebSocket endpoints are missing appropriate authentication, allowing attackers to impersonate charging stations and manipulate data sent to the backend. An unauthenticated attacker can connect to the OCPP WebSocket endpoint using a known or discovered charging station identifier and then issue or receive OCPP commands as a legitimate charger. This can lead to privilege escalation, unauthorized control of charging infrastructure, and corruption of charging network data. The affected API endpoint is the OCPP WebSocket endpoint. The vulnerable parameter is the charging station identifier. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.