rootpwn

critical · CVSS v3 9.4 · CVSS v4 9.3

CVE-2026-95102

CVE-2026-95102 exposes WebSocket endpoints in charging station systems that lack authentication, allowing attackers to impersonate stations.

Overview

CVE-2026-95102 exposes WebSocket endpoints in charging station systems that lack authentication, allowing attackers to impersonate stations. This flaw can lead to unauthorized data access and control over charging operations. The vulnerability is rated critical with a CVSS v3 score of 9.4.

Description

WebSocket endpoints lack proper authentication mechanisms, enabling attackers to impersonate charging stations. As a result, attackers can exploit this weakness to gain unauthorized access to sensitive data or perform unauthorized actions. Given that no authentication is required, this can lead to privilege escalation and potentially compromise the security of the entire system.

Impact

The lack of authentication violates confidentiality, integrity, and availability of charging station data and operations. Attackers can read sensitive data, modify charging commands, or disrupt service. Operators, fleet managers, and end‑users are directly impacted.

Remediation

Apply vendor‑issued patches that enforce authentication on WebSocket endpoints. If no patch is available, restrict WebSocket traffic to trusted IP ranges and enforce TLS with client certificates. Monitor for anomalous WebSocket connections and disable unused endpoints.

Risk context

The vulnerability is critical (CVSS 9.4) and poses an immediate threat to charging infrastructure. Defenders should prioritize remediation to prevent potential system compromise.

Affected products

  • EV charging station firmware
  • EV charging station API
  • charging station management platform
  • charging station WebSocket service
  • EV charging software

Scores

Severity
critical
CVSS v2
9.7
CVSS v3
9.4
CVSS v4
9.3
EPSS
—

websocket authentication charging-station critical iot

← All CVEs

Related CVEs

critical

CVE-2026-104414

Ghost from 2.5.0 before 6.64.0 contains a stored cross-site scripting vulnerability that allows attackers to inject untrusted scripts into post content via oEmbed photo responses. Attackers can host malicious oEmbed photo responses so that embedding their URL stores scripts that run in the Ghost editor, published site, and newsletter emails, compromising staff admin sessions.

View analysis

critical

CVE-2026-94298

The BuildKit WordPress plugin before 1.0.29 does not properly sanitise and escape data submitted by contributor-level users before storing it and later using it in a SQL query, allowing a Contributor to inject SQL that runs against the database once the resulting content is published and viewed by any unauthenticated visitor.

View analysis

critical

CVE-2026-93698

CVE-2026-93698 exposes the Multilang adminbin to arbitrary command execution due to insufficient input validation. Attackers can run any system command via the admin interface, potentially compromising the entire host. This flaw is critical and can be exploited remotely by authenticated or unauthenticated users with admin access.

View analysis

critical

CVE-2026-97637

The WordPress JSON API Auth plugin (up to 3.1.2) caches responses without considering HTTP method or POST body, allowing unauthenticated users to retrieve a live admin session cookie from the generate_auth_cookie endpoint. This exposes a valid Administrator logged_in cookie that can be used to impersonate the site admin. The flaw requires the PI-Media/json-api parent plugin to be active and an admin to have posted to the endpoint within the 24‑hour cache TTL.

View analysis