CISA has reported multiple vulnerabilities in EV Energy’s electric vehicle charging platform that could allow attackers to gain full administrative control over charging networks, with no official patches available from the vendor.
The most critical flaw, CVE-2026-27772, carries a CVSS score of 9.4 and involves a missing authentication mechanism in WebSocket endpoints. An unauthenticated attacker can connect to the Open Charge Point Protocol WebSocket using a discovered station identifier, then send and receive commands as if they were a legitimate charger. This grants full infrastructure control including the ability to disrupt charging services, corrupt usage data, and potentially damage physical hardware.
CVE-2026-24445 describes a rate-limiting deficiency in the WebSocket API that enables brute-force attacks and denial-of-service scenarios by suppressing or misrouting legitimate charger telemetry. Attackers can exploit this to lock out genuine charging stations or flood the backend with malicious traffic.
Two additional vulnerabilities compound the risk. CVE-2026-26290 involves insufficient session expiration, allowing multiple connections to reuse the same predictable session identifier for hijacking or shadowing attacks. CVE-2026-25774 is an information disclosure flaw where charging station authentication identifiers are publicly accessible through web-based mapping platforms, providing attackers with the credentials needed to exploit the WebSocket vulnerabilities.
All versions of the ev.energy platform are affected. Because the vendor did not respond to CISA’s coordination requests, no software patches exist. CISA recommends organizations isolate control systems from the internet, deploy firewalls, and use VPNs for any required remote management as compensatory measures.
