CVE-2026-27028: CWE-306 in Mobility46 mobility46.se
WebSocket endpoints lack proper authentication mechanisms, enabling attackers to perform unauthorized station impersonation and manipulate data sent to the backend. An unauthenticated attacker can connect to the OCPP WebSocket endpoint using a known or discovered charging station identifier, then issue or receive OCPP commands as a legitimate charger. Given that no authentication is required, this can lead to privilege escalation, unauthorized control of charging infrastructure, and corruption of charging network data reported to the backend.
AI Analysis
Technical Summary
This vulnerability (CVE-2026-27028) involves the absence of authentication on WebSocket endpoints in Mobility46's mobility46.se product. Attackers can connect to the OCPP WebSocket endpoint without credentials by using a known or discovered charging station identifier. This lack of authentication (CWE-306) allows unauthorized station impersonation, enabling attackers to send or receive OCPP commands as legitimate chargers. The impact includes privilege escalation, unauthorized control over charging infrastructure, and potential corruption of charging network data reported to the backend. The vulnerability affects all versions of the product and has a CVSS 3.1 base score of 9.4 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L). No patches or mitigations are currently documented.
Potential Impact
An unauthenticated attacker can impersonate a charging station by connecting to the WebSocket endpoint using a valid station identifier. This allows unauthorized issuance and reception of OCPP commands, leading to privilege escalation and unauthorized control of the charging infrastructure. Additionally, attackers can corrupt the data reported to the backend, impacting data integrity. The confidentiality and integrity impacts are high, while availability impact is low. No known exploits have been reported in the wild to date.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or patch is currently available, users should restrict access to the WebSocket endpoints through network controls where possible and monitor for suspicious activity. Avoid exposing the OCPP WebSocket endpoint to untrusted networks until a patch or official mitigation is released by Mobility46.
CVE-2026-27028: CWE-306 in Mobility46 mobility46.se
Description
WebSocket endpoints lack proper authentication mechanisms, enabling attackers to perform unauthorized station impersonation and manipulate data sent to the backend. An unauthenticated attacker can connect to the OCPP WebSocket endpoint using a known or discovered charging station identifier, then issue or receive OCPP commands as a legitimate charger. Given that no authentication is required, this can lead to privilege escalation, unauthorized control of charging infrastructure, and corruption of charging network data reported to the backend.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
This vulnerability (CVE-2026-27028) involves the absence of authentication on WebSocket endpoints in Mobility46's mobility46.se product. Attackers can connect to the OCPP WebSocket endpoint without credentials by using a known or discovered charging station identifier. This lack of authentication (CWE-306) allows unauthorized station impersonation, enabling attackers to send or receive OCPP commands as legitimate chargers. The impact includes privilege escalation, unauthorized control over charging infrastructure, and potential corruption of charging network data reported to the backend. The vulnerability affects all versions of the product and has a CVSS 3.1 base score of 9.4 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L). No patches or mitigations are currently documented.
Potential Impact
An unauthenticated attacker can impersonate a charging station by connecting to the WebSocket endpoint using a valid station identifier. This allows unauthorized issuance and reception of OCPP commands, leading to privilege escalation and unauthorized control of the charging infrastructure. Additionally, attackers can corrupt the data reported to the backend, impacting data integrity. The confidentiality and integrity impacts are high, while availability impact is low. No known exploits have been reported in the wild to date.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or patch is currently available, users should restrict access to the WebSocket endpoints through network controls where possible and monitor for suspicious activity. Avoid exposing the OCPP WebSocket endpoint to untrusted networks until a patch or official mitigation is released by Mobility46.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- icscert
- Date Reserved
- 2026-02-24T00:35:18.464Z
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 69a0ebae32ffcdb8a293f331
Added to database: 2/27/2026, 12:56:14 AM
Last enriched: 4/9/2026, 10:11:43 PM
Last updated: 4/13/2026, 1:53:35 AM
Views: 90
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.