CVE-2026-25192 is a critical missing authentication flaw (CVSS 9.4) in CTEK Chargeportal, a backend for electric vehicle charging. The OCPP WebSocket endpoint needs no authentication, so someone who knows a charging station identifier can act as that charger. CISA says CTEK will sunset the product in April 2026.
What's affected
- Affected: CTEK Chargeportal, all versions.
- Fixed in: no fixed version is listed. CISA's advisory ICSA-26-078-06 says CTEK will be sunsetting this product in April 2026 and points customers to CTEK support.
The advisory covers several issues in the same product. This record covers the missing authentication on the WebSocket endpoint. The advisory summary says attackers could gain unauthorized administrative control over charging stations or disrupt charging services.
How to check if you're exposed
If you operate or depend on Chargeportal, you are in scope. Find out whether the WebSocket endpoint is reachable from the internet, and whether anything in front of it checks the identity of the connecting charger. Review backend logs for connections from addresses you do not recognize, and for charger identifiers that appear from two places at once.
What to do now
- Contact CTEK support for current guidance, as the advisory directs.
- Plan a move to a supported charging backend, because the product is being sunset.
- Until then, restrict the WebSocket endpoint to known charger networks with firewall rules or a VPN.
- Add a gateway that requires credentials or client certificates for charger connections, if your chargers support it.
- Monitor for unexpected commands and for chargers that report data inconsistent with their location.
Why it matters
The OCPP protocol is how chargers and a central system talk. If the central system accepts any client that names a charger identifier, identifiers become the only secret, and they are often guessable or printed on the hardware. The weakness is CWE-306 (Missing Authentication for Critical Function). The consequence is control of infrastructure and corrupted data reported to the backend.
An end of life product raises the stakes. Anything you do now is a stopgap. The durable fix is a supported system with authentication on every charger connection.
Quick check
Is a patch available?
No fixed version is listed. CISA says the product is being sunset and tells customers to contact CTEK.
Is CVE-2026-25192 exploited in the wild?
The record does not mark it as a CISA Known Exploited Vulnerability, and the advisory does not report exploitation.
Sources
Last reviewed: 19 October 2026.
