CVE-2026-24731 is a critical (CVSS 9.4) missing authentication flaw in the EV2GO OCPP WebSocket endpoint. Anyone who knows a charging station identifier can act as that charger. CISA says the vendor did not respond to coordination and lists all versions as affected, so contact the vendor and apply compensating controls.
What's affected
CISA advisory ICSA-26-057-04 lists EV2GO ev2go.io, all versions, as known affected. It covers four CVEs. For remediation, CISA states that EV2GO did not respond to its request for coordination, and points to the vendor's contact page.
The record says WebSocket endpoints lack authentication. An unauthenticated attacker can connect to the OCPP endpoint with a known or discovered charging station identifier, then issue or receive OCPP commands as a legitimate charger. The result can be unauthorized control of charging infrastructure and corrupted data reported to the backend.
How to check if you're exposed
If you operate stations on this backend, ask the vendor in writing how station identity is verified and what the fix plan is for the four CVEs.
On your side, check which identifiers your stations use and whether they are guessable or published. Look at connection logs for two connections claiming the same station identifier, or for stations that report in at odd times.
What to do now
- Contact EV2GO and ask for a fix timeline for the CVEs in ICSA-26-057-04.
- Where you control the network path, require mutual TLS or an authenticated proxy in front of the WebSocket endpoint.
- Use station identifiers that are hard to guess, and treat them as sensitive.
- Alert on duplicate station connections and unexpected commands.
- Track the CISA advisory for revisions.
Why it matters
The weakness is CWE-306, missing authentication for a critical function. OCPP is the protocol chargers use to talk to a backend. If the backend accepts any client that names a station, identity is a label and not a credential.
Charging networks are connected to physical equipment and to payment and grid data, so a bad actor posing as a station can corrupt records or take over commands. The CVE is not in CISA's Known Exploited Vulnerabilities catalog.
Quick check
Is there a vendor fix?
CISA says EV2GO did not respond to its coordination request.
What does the flaw let someone do?
Per the record, act as a legitimate charger by connecting with a known or discovered station identifier.
Sources
Last reviewed: 19 October 2026.
