CVE-2026-20744

CriticalCVSS 9.8

Published: 10/07/2026(UTC)Updated: 25/10/2026(UTC)Translated: 15/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Elevated risk

0.76%

55th percentile - higher than 55% of all known CVEs

Summary

The charging station websocket endpoint accepts connections without proper authentication, which could lead to privilege escalation.

Risk Assessment

An attacker could gain unauthorized access to administrative functions of the charging station, potentially taking control and disrupting the charging infrastructure.

Recommendation

Immediately implement authentication for WebSocket connections, e.g., via session tokens or client certificates, and update the charging station software to the latest version.

Other vulnerabilities in ChargingStation

CVE-2026-22099High
The charging station does not require authentication for Bluetooth commands, allowing unauthorized devices to perform actions. The vulnerability enables sensitive information leakage, triggering reboots, or pushing a firmware update URL.

Original NVD description (English source)

The charging station websocket endpoint accepts connections without proper authentication, which could lead to privilege escalation.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS