CVE-2026-25192
Published: 20 March 2026
Summary
CVE-2026-25192 is a critical-severity Missing Authentication for Critical Function (CWE-306) vulnerability in Ctek Charge Portal. Its CVSS base score is 9.3 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 37.9th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 AC-14 (Permitted Actions Without Identification or Authentication) and IA-3 (Device Identification and Authentication).
Deeper analysis
CVE-2026-25192 is a high-severity vulnerability (CVSS 9.4, CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L) stemming from WebSocket endpoints lacking proper authentication mechanisms, as documented under CWE-306 (Missing Authentication for Critical Function). It affects OCPP (Open Charge Point Protocol) WebSocket endpoints in charging station software, specifically those from CTEK, enabling attackers to perform unauthorized station impersonation and manipulate data sent to backend systems.
An unauthenticated attacker with network access can exploit this by connecting to the OCPP WebSocket endpoint using a known or discovered charging station identifier. This allows them to issue or receive OCPP commands as a legitimate charger, resulting in privilege escalation, unauthorized control over charging infrastructure, and corruption of charging network data reported to the backend.
CISA advisory ICSA-26-078-06 and related resources, including CTEK's support page, provide details on mitigation strategies; practitioners should consult these references for patching instructions and remediation guidance.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-13846
Vulnerability details
WebSocket endpoints lack proper authentication mechanisms, enabling attackers to perform unauthorized station impersonation and manipulate data sent to the backend. An unauthenticated attacker can connect to the OCPP WebSocket endpoint using a known or discovered charging station identifier, then issue…
more
or receive OCPP commands as a legitimate charger. Given that no authentication is required, this can lead to privilege escalation, unauthorized control of charging infrastructure, and corruption of charging network data reported to the backend.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Unauthenticated WebSocket endpoints enable exploitation of public-facing application (T1190) for initial access via missing authentication, facilitating privilege escalation (T1068) through unauthorized station impersonation and control.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly requires limiting permitted actions without identification or authentication, preventing unauthorized station impersonation and data manipulation on unauthenticated WebSocket endpoints.
Mandates device identification and authentication before establishing connections, mitigating impersonation of charging stations via OCPP WebSocket endpoints.
Ensures authenticity of communications sessions like WebSockets by requiring unique identification and authentication, blocking unauthorized command issuance and data corruption.