CVE-2026-22552 is a critical missing authentication flaw (CVSS 9.4) in the OCPP WebSocket endpoints of epower.ie. An unauthenticated attacker who knows a charging station identifier could act as that charger. The record gives no fixed version, so follow CISA advisory ICSA-26-062-07 and contact the vendor.
What's affected
The ePower (epower.ie) charging network backend, specifically its OCPP WebSocket endpoints. The record gives no version range and no fixed version.
The references are the vendor support page and CISA advisory ICSA-26-062-07 with its CSAF file. Use those for current product and remediation details.
How to check if you're exposed
The record gives no version to check. If you operate or rely on this charging backend, ask the vendor whether your deployment is affected.
If you run your own OCPP server, test in a lab whether it accepts a WebSocket connection for a charger identifier without any credential. If it does, the same weakness class is present in your setup.
What to do now
- Read CISA advisory ICSA-26-062-07 and the vendor support page for remediation steps.
- Ask the vendor to confirm whether your deployment is affected and when a fix will ship.
- Require authentication on the OCPP endpoint, for example client certificates or basic credentials per charger, where the platform supports it.
- Treat charger identifiers as non secret. Do not rely on them as a form of authentication.
- Review backend data for sessions or commands from stations that should not have connected.
Why it matters
The weakness is CWE-306, missing authentication for a critical function. Per the record, a client that knows a station identifier can connect to the OCPP WebSocket endpoint and send or receive commands as that charger. Nothing proves the client is a real charger.
The consequences listed are unauthorized control of charging infrastructure and corruption of charging data reported to the backend. The record says a known or discovered identifier is enough, so the identifier works as a username with no password. The record does not say the flaw is exploited, and it is not on the CISA KEV list.
Quick check
Is a patch available?
The record does not name a fixed version. Check CISA advisory ICSA-26-062-07 and ask the vendor.
What is OCPP?
The record uses it for the protocol chargers use to talk to a backend over WebSocket. The weakness is that the endpoint does not verify who is connecting.
Sources
Last reviewed: 19 October 2026.
